defendnot | d1a51a57b18261dc57cd47c17ab447930904981ed0ce918d4d0c5478707e5030

General

Target
2026-09-22_c157a489271a6c3422c549ddb7ff8b89_coinminer_dosia_elex_frostygoop_glassworm_hive_http-browser_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 13.9MB
Sample260922-gttxcsvzf1
SHA256 d1a51a57b18261dc57cd47c17ab447930904981ed0ce918d4d0c5478707e5030
MD5 c157a489271a6c3422c549ddb7ff8b89
SHA1 b95194b07149150e9fa382f6eda11cd83c72a841
SHA512 6e65270e80c541d923a5a50d7c83e0100897698ae17faac08245b8c36c8f0b4216e7ae79e6089349dd5b278120dbd11d1561d1722e54870568d00c09ac80e17c
SSDEEP 196608:15WXYfsuB8j3HiV0bdMKIjjQJddbPd8eDDD02neSrbnQ5Z5sTjVY:TTUuB8j3rbLBfDk2neUgsdY
TLSH
T1D2E6BD41FE8B50F6E907583150ABB36F63306D064B39CBD7EB457B6AF8B72821836245
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-22_c157a489271a6c3422c549ddb7ff8b89_coinminer_dosia_elex_frostygoop_glassworm_hive_http-browser_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 13.9MB
- SHA256 d1a51a57b18261dc57cd47c17ab447930904981ed0ce918d4d0c5478707e5030
- MD5 c157a489271a6c3422c549ddb7ff8b89
- SHA1 b95194b07149150e9fa382f6eda11cd83c72a841
- SHA512 6e65270e80c541d923a5a50d7c83e0100897698ae17faac08245b8c36c8f0b4216e7ae79e6089349dd5b278120dbd11d1561d1722e54870568d00c09ac80e17c
- SSDEEP 196608:15WXYfsuB8j3HiV0bdMKIjjQJddbPd8eDDD02neSrbnQ5Z5sTjVY:TTUuB8j3rbLBfDk2neUgsdY
- TLSH
  T1D2E6BD41FE8B50F6E907583150ABB36F63306D064B39CBD7EB457B6AF8B72821836245
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution defendnot salatstealer hacktool stealer upx persistence
- Detect SalatStealer payload
- Detects Defendnot
- Family: Defendnot
  Defendnot is a tool designed to disable Microsoft Defender.
  hacktool defendnot
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2