10499a4f9a7aa4ed908d684862650883c3c588b7d2496f6d88056083a2beb30f

General

Target
2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 10.3MB
Sample260825-s792aavema
SHA256 10499a4f9a7aa4ed908d684862650883c3c588b7d2496f6d88056083a2beb30f
MD5 344fe2d2d0557e99e0b2a53d52b94525
SHA1 7c6b0b822124f1eb41534ea1128a193976d75f76
SHA512 7782121e588b49cc51c6e49bf67bf61d5bf5bcd1402037b66bec8e0a0a0ec93f2a734a05469334efbaf8aa3b891d487e1c9d7a98eeaf970115f6c260171d3320
SSDEEP 98304:lykOISc5KRHFfz4zoGLSuD0Yn7oCtyRFESlloqOyF8lI:lemcRHqZgsVQ2SlloqO
TLSH
T18BB64B47E8A541E4C0EED575C6669663BA713C984F3063D32F60FB242F76BD06ABA700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-24_344fe2d2d0557e99e0b2a53d52b94525_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 10.3MB
- SHA256 10499a4f9a7aa4ed908d684862650883c3c588b7d2496f6d88056083a2beb30f
- MD5 344fe2d2d0557e99e0b2a53d52b94525
- SHA1 7c6b0b822124f1eb41534ea1128a193976d75f76
- SHA512 7782121e588b49cc51c6e49bf67bf61d5bf5bcd1402037b66bec8e0a0a0ec93f2a734a05469334efbaf8aa3b891d487e1c9d7a98eeaf970115f6c260171d3320
- SSDEEP 98304:lykOISc5KRHFfz4zoGLSuD0Yn7oCtyRFESlloqOyF8lI:lemcRHqZgsVQ2SlloqO
- TLSH
  T18BB64B47E8A541E4C0EED575C6669663BA713C984F3063D32F60FB242F76BD06ABA700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access discovery execution persistence spyware stealer
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables referencing virtualization MAC addresses
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2