01ddefe7ba4700ff1f32368479b953b1b98fdceed40be9bc8005ae0c8c3ef1f7

General

Target
2026-08-25_9120bd0fe21b66486a4723abb3ca50b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 10.3MB
Sample260826-vz2faagr2w
SHA256 01ddefe7ba4700ff1f32368479b953b1b98fdceed40be9bc8005ae0c8c3ef1f7
MD5 9120bd0fe21b66486a4723abb3ca50b0
SHA1 bddf89a869682516792c2c004872e3c8930c578c
SHA512 24ab960dd6547e27d5de13b00509e3978a643acac9e4c546efca36ebd7535817a428050c945a56866e6a198a687cbcf3ed285bbafdb7171b211505fc4a049d01
SSDEEP 98304:Ep9mxB/A/9MLC8dKPHLymAWfI5oR042qbK/EX9lJefvF8z3ak:E2k9MLmFgcdKcX9lJef
TLSH
T110B64A57ECA501E4C0AED575CA669623BA713C894F3063D36B50FB382F76BE0697A700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-25_9120bd0fe21b66486a4723abb3ca50b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 10.3MB
- SHA256 01ddefe7ba4700ff1f32368479b953b1b98fdceed40be9bc8005ae0c8c3ef1f7
- MD5 9120bd0fe21b66486a4723abb3ca50b0
- SHA1 bddf89a869682516792c2c004872e3c8930c578c
- SHA512 24ab960dd6547e27d5de13b00509e3978a643acac9e4c546efca36ebd7535817a428050c945a56866e6a198a687cbcf3ed285bbafdb7171b211505fc4a049d01
- SSDEEP 98304:Ep9mxB/A/9MLC8dKPHLymAWfI5oR042qbK/EX9lJefvF8z3ak:E2k9MLmFgcdKcX9lJef
- TLSH
  T110B64A57ECA501E4C0AED575CA669623BA713C894F3063D36B50FB382F76BE0697A700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence trojan collection credential_access spyware stealer
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables referencing virtualization MAC addresses
- Looks for VirtualBox drivers on disk
  defense_evasion
- detects Windows exceutables potentially bypassing UAC using fodhelper.exe
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks whether UAC is enabled
  defense_evasion trojan
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2