ea48d4d4e15af89a5f64efcbd199fbd68b9c79c51f95c540bb354e7637f9f83d

General

Target
2026-08-19_20fa8f66fbca11d4c1b6e06943f247bc_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 10.4MB
Sample260820-axcc6acm4y
SHA256 ea48d4d4e15af89a5f64efcbd199fbd68b9c79c51f95c540bb354e7637f9f83d
MD5 20fa8f66fbca11d4c1b6e06943f247bc
SHA1 71f15fe1810fcafdb20337f9b6e1aec31ff18630
SHA512 624b988b58b26b460db5a5810ebbef57f7e8e544abfd60a89fd2bcf69612af978ad5519f31d0c6f7dc263b1028c01af950dc2a28e70c9d51294c10f275a3caa6
SSDEEP 98304:Bn2/QNMyTGLNRPa/+yhES1y5558mZedFpEE:B28MkGLbP9558YeN9
TLSH
T1DEB63947ECB542E5C0AED176C6669253BA713C884F3063D72B60B7242F76BD0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-19_20fa8f66fbca11d4c1b6e06943f247bc_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 10.4MB
- SHA256 ea48d4d4e15af89a5f64efcbd199fbd68b9c79c51f95c540bb354e7637f9f83d
- MD5 20fa8f66fbca11d4c1b6e06943f247bc
- SHA1 71f15fe1810fcafdb20337f9b6e1aec31ff18630
- SHA512 624b988b58b26b460db5a5810ebbef57f7e8e544abfd60a89fd2bcf69612af978ad5519f31d0c6f7dc263b1028c01af950dc2a28e70c9d51294c10f275a3caa6
- SSDEEP 98304:Bn2/QNMyTGLNRPa/+yhES1y5558mZedFpEE:B28MkGLbP9558YeN9
- TLSH
  T1DEB63947ECB542E5C0AED176C6669253BA713C884F3063D72B60B7242F76BD0AEB9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2