b94cb212a2c4d586e7f79c91cff5b0ee5774909834d50ad904f9915d83bdaa87

General

Target
2026-08-27_5de076ecf7a6e11038f5f7fd9b71e253_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 10.2MB
Sample260827-vcz9psyclb
SHA256 b94cb212a2c4d586e7f79c91cff5b0ee5774909834d50ad904f9915d83bdaa87
MD5 5de076ecf7a6e11038f5f7fd9b71e253
SHA1 96c97e27b74e585cf2a8f4d48394c24904d7c963
SHA512 4671c5e0b5341bda552398ee213a6a38bc9beb36e2b73b0b52249336b32b505700e12b3adc6e787de56960dfe2c86b27ae0a4dc151a028df879cb5967212ef0e
SSDEEP 98304:3RfnO1+PcqnkTjsBB54RmWKKgw8eKA4EJb3rV/80wgWIFio:3Vo7qnkTYgEqK4Jb3rGIFJ
TLSH
T112B64A47E8A501A4C0EED175CA669663BA713C984F3063D76F50F7283F76BD0AAB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-27_5de076ecf7a6e11038f5f7fd9b71e253_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 10.2MB
- SHA256 b94cb212a2c4d586e7f79c91cff5b0ee5774909834d50ad904f9915d83bdaa87
- MD5 5de076ecf7a6e11038f5f7fd9b71e253
- SHA1 96c97e27b74e585cf2a8f4d48394c24904d7c963
- SHA512 4671c5e0b5341bda552398ee213a6a38bc9beb36e2b73b0b52249336b32b505700e12b3adc6e787de56960dfe2c86b27ae0a4dc151a028df879cb5967212ef0e
- SSDEEP 98304:3RfnO1+PcqnkTjsBB54RmWKKgw8eKA4EJb3rV/80wgWIFio:3Vo7qnkTYgEqK4Jb3rGIFJ
- TLSH
  T112B64A47E8A501A4C0EED175CA669663BA713C984F3063D76F50F7283F76BD0AAB9700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access defense_evasion discovery execution persistence spyware stealer trojan
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables referencing virtualization MAC addresses
- detects Windows exceutables potentially bypassing UAC using fodhelper.exe
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks whether UAC is enabled
  defense_evasion trojan
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2