619cf940b7947067a21841934f7239789af057956eb653c9d6d503276d540a70

General

Target
2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 15.5MB
Sample260910-ltsrhsvsa1
SHA256 619cf940b7947067a21841934f7239789af057956eb653c9d6d503276d540a70
MD5 dcd8a35417a675e01a9210a2be846400
SHA1 6e8bd4773d309a6d6c4dac1869a52526d692044b
SHA512 da40b02c68393e3ac7e612fed8ebc01fa3d1cffc8c738e173a01f3b46197742e84042cb40e5304e7365a2dcdd5b7a694676d9696db78a3ed5f9299722df8c34a
SSDEEP 196608:9S0kvPm1soJLhIuyM6MeuVqw8kOx3CGQcsJt:9YvPm1RFyAZmPsD
TLSH
T167F66B43E8A145E9C09AD6758A279157BE703C894F3063D76F90BB292F337D0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 15.5MB
- SHA256 619cf940b7947067a21841934f7239789af057956eb653c9d6d503276d540a70
- MD5 dcd8a35417a675e01a9210a2be846400
- SHA1 6e8bd4773d309a6d6c4dac1869a52526d692044b
- SHA512 da40b02c68393e3ac7e612fed8ebc01fa3d1cffc8c738e173a01f3b46197742e84042cb40e5304e7365a2dcdd5b7a694676d9696db78a3ed5f9299722df8c34a
- SSDEEP 196608:9S0kvPm1soJLhIuyM6MeuVqw8kOx3CGQcsJt:9YvPm1RFyAZmPsD
- TLSH
  T167F66B43E8A145E9C09AD6758A279157BE703C894F3063D76F90BB292F337D0AEB9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence privilege_escalation
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2