154d984416941d6242bb44d6889b769095fc0530f75a0f6c8bb80df97d909aca

General

Target
2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 13.3MB
Sample260831-2c59aazdpe
SHA256 154d984416941d6242bb44d6889b769095fc0530f75a0f6c8bb80df97d909aca
MD5 1ef1d22a0a69c2921f6500e37dd9098e
SHA1 875e7e2fe55a9e4d9935fee142508c946c779648
SHA512 5c55b1f9450371ab75957d3da0242b970ec6a9dddf9aa1929400503eeaccd82487a7dacad38229793ecebef97f23309d6db368c1df0dc2a9fb40676e42ec9b11
SSDEEP 98304:3LV9QQzd86EnOWsDPD8VXCK6CSrNWPwLlsZAo6aqECXnfkLzQe6grJaTW7re/J:7VhC6EO8cvMwKCXnfkLzQe6grJ1G
TLSH
T13CE65B47E9A501E4C0AED535C6669663BA707C884B3463D77F50F7382F36BD0AAB9B00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-31_1ef1d22a0a69c2921f6500e37dd9098e_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 13.3MB
- SHA256 154d984416941d6242bb44d6889b769095fc0530f75a0f6c8bb80df97d909aca
- MD5 1ef1d22a0a69c2921f6500e37dd9098e
- SHA1 875e7e2fe55a9e4d9935fee142508c946c779648
- SHA512 5c55b1f9450371ab75957d3da0242b970ec6a9dddf9aa1929400503eeaccd82487a7dacad38229793ecebef97f23309d6db368c1df0dc2a9fb40676e42ec9b11
- SSDEEP 98304:3LV9QQzd86EnOWsDPD8VXCK6CSrNWPwLlsZAo6aqECXnfkLzQe6grJaTW7re/J:7VhC6EO8cvMwKCXnfkLzQe6grJ1G
- TLSH
  T13CE65B47E9A501E4C0AED535C6669663BA707C884B3463D77F50F7382F36BD0AAB9B00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence trojan collection credential_access spyware stealer
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables referencing virtualization MAC addresses
- detects Windows exceutables potentially bypassing UAC using fodhelper.exe
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks whether UAC is enabled
  defense_evasion trojan
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2