c9a69b9a8b53ef8803b170a3d786c86eafcdea0a314dcdde39abdd80891c45a8

General

Target
2026-09-10_eb227402951b434002e4f25afa46ffd9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 15.6MB
Sample260910-k7lppaam5s
SHA256 c9a69b9a8b53ef8803b170a3d786c86eafcdea0a314dcdde39abdd80891c45a8
MD5 eb227402951b434002e4f25afa46ffd9
SHA1 133ece2a2d5e3871cf114a17690ffc9a5eb5298e
SHA512 fc89cd7e774583e7c50f22cba9459591cd810dd8db3a788c84076ef2fce0f0d6a45808ff57a3c9da32d7ae81c03b5d64bfa4ddb2d00730549f17e149767adca0
SSDEEP 98304:RnklfTl2RP3WSFtQSFYbZYJpkoMfoveSOif6MenN8gA2ewDnOx30kc1GQE6dZTk2:RUl2V3WXbaMQTf6MeNfbOx3CGQbddl
TLSH
T10CF65B47E8B145E8C0EAD535CA679157BA713C894F3163D36F90BA242F32BD0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-09-10_eb227402951b434002e4f25afa46ffd9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 15.6MB
- SHA256 c9a69b9a8b53ef8803b170a3d786c86eafcdea0a314dcdde39abdd80891c45a8
- MD5 eb227402951b434002e4f25afa46ffd9
- SHA1 133ece2a2d5e3871cf114a17690ffc9a5eb5298e
- SHA512 fc89cd7e774583e7c50f22cba9459591cd810dd8db3a788c84076ef2fce0f0d6a45808ff57a3c9da32d7ae81c03b5d64bfa4ddb2d00730549f17e149767adca0
- SSDEEP 98304:RnklfTl2RP3WSFtQSFYbZYJpkoMfoveSOif6MenN8gA2ewDnOx30kc1GQE6dZTk2:RUl2V3WXbaMQTf6MeNfbOx3CGQbddl
- TLSH
  T10CF65B47E8B145E8C0EAD535CA679157BA713C894F3163D36F90BA242F32BD0AEB9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence privilege_escalation
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2