defendnot | b96c98325b61ef08ee846b1f825c16fcf93541a3de4130bdc9d701e5265bc4f6

General

Target
2026-09-21_08d4c0ca2c61a1b73a59f8c178bd10dd_coinminer_dosia_elex_frostygoop_glassworm_hive_http-browser_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 13.6MB
Sample260922-e9e22avxb1
SHA256 b96c98325b61ef08ee846b1f825c16fcf93541a3de4130bdc9d701e5265bc4f6
MD5 08d4c0ca2c61a1b73a59f8c178bd10dd
SHA1 848b6bc1ef51be486a6353bd0078f89dd747e46b
SHA512 7d3263d54dd6e74b0da2de603ea9f891cf4731c3ee18b79d207ef5838f1879e7212c87ae7c6f64c9bde9c08df955fafee3e1a316ca125f842336c5b784da8f73
SSDEEP 196608:NKPP7mJGL7tHujGEZb+wQYHqzOC7T/QzTgKneSrbnQ5Z5sTjVYmX:RIPBujGEZb+wST/QzXneUgsdYmX
TLSH
T1E2E6BE41FEDB40F6EA03593115ABB26F63309D064F25CB97EB817BA9ED372921D32205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-21_08d4c0ca2c61a1b73a59f8c178bd10dd_coinminer_dosia_elex_frostygoop_glassworm_hive_http-browser_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 13.6MB
- SHA256 b96c98325b61ef08ee846b1f825c16fcf93541a3de4130bdc9d701e5265bc4f6
- MD5 08d4c0ca2c61a1b73a59f8c178bd10dd
- SHA1 848b6bc1ef51be486a6353bd0078f89dd747e46b
- SHA512 7d3263d54dd6e74b0da2de603ea9f891cf4731c3ee18b79d207ef5838f1879e7212c87ae7c6f64c9bde9c08df955fafee3e1a316ca125f842336c5b784da8f73
- SSDEEP 196608:NKPP7mJGL7tHujGEZb+wQYHqzOC7T/QzTgKneSrbnQ5Z5sTjVYmX:RIPBujGEZb+wST/QzXneUgsdYmX
- TLSH
  T1E2E6BE41FEDB40F6EA03593115ABB26F63309D064F25CB97EB817BA9ED372921D32205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution defendnot salatstealer hacktool stealer upx persistence
- Detect SalatStealer payload
- Detects Defendnot
- Family: Defendnot
  Defendnot is a tool designed to disable Microsoft Defender.
  hacktool defendnot
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2