defendnot | 617739f264479ff970bd61c77cade4750fa49ecb82f1104c91c5a6bce197426b

General

Target
2026-09-22_a13bcc56c8037a92e6ed2fd78c5f2417_coinminer_dosia_elex_frostygoop_glassworm_hive_http-browser_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 13.7MB
Sample260923-ac7cssvbjf
SHA256 617739f264479ff970bd61c77cade4750fa49ecb82f1104c91c5a6bce197426b
MD5 a13bcc56c8037a92e6ed2fd78c5f2417
SHA1 a0aefaab9ba95230ad6fcdff26f46b1329d01637
SHA512 8a7848be60b9a43cbabed5bbe1b1de3f96f85e85e836147491a9aa3219f6027a33c24fab187a0dfc0f4f5bb825cb0d985c721bba5e10f6d24ad57774b54d8a02
SSDEEP 196608:J/SB8eAsgSQZ1yaAa/rRacUK8neSrbnQ5Z5sTjVYt:BL1yusc58neUgsdYt
TLSH
T121E6BE41FE8B54F6E907493114ABB26F2330AD058F29CBD7FB407A6AF9376925837205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-22_a13bcc56c8037a92e6ed2fd78c5f2417_coinminer_dosia_elex_frostygoop_glassworm_hive_http-browser_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 13.7MB
- SHA256 617739f264479ff970bd61c77cade4750fa49ecb82f1104c91c5a6bce197426b
- MD5 a13bcc56c8037a92e6ed2fd78c5f2417
- SHA1 a0aefaab9ba95230ad6fcdff26f46b1329d01637
- SHA512 8a7848be60b9a43cbabed5bbe1b1de3f96f85e85e836147491a9aa3219f6027a33c24fab187a0dfc0f4f5bb825cb0d985c721bba5e10f6d24ad57774b54d8a02
- SSDEEP 196608:J/SB8eAsgSQZ1yaAa/rRacUK8neSrbnQ5Z5sTjVYt:BL1yusc58neUgsdYt
- TLSH
  T121E6BE41FE8B54F6E907493114ABB26F2330AD058F29CBD7FB407A6AF9376925837205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution defendnot salatstealer hacktool stealer upx persistence
- Detect SalatStealer payload
- Detects Defendnot
- Family: Defendnot
  Defendnot is a tool designed to disable Microsoft Defender.
  hacktool defendnot
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2