5c98cd8d65a54925a0ab3d826e57da8c4dcf1814228f705f895bfad2b3397c08

General

Target
2026-09-27_75cf9cfbd4ccbe526aea1094cb4cf244_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 5.6MB
Sample260928-e4kqbsvcmd
SHA256 5c98cd8d65a54925a0ab3d826e57da8c4dcf1814228f705f895bfad2b3397c08
MD5 75cf9cfbd4ccbe526aea1094cb4cf244
SHA1 be286681d4281da0f0e7914dd1b5df7963e82229
SHA512 98c714e1510c838e48b101769a290777b3881611abc8756720ad28a24b57a599756e9887d30e1eff9f6fea4db1044b2bb009509e7c2c79cb62ddcb0150a04d5d
SSDEEP 49152:jQ3WprK5qFNQyjx+lMRJdlgMMG8baA28GbIMIOI2REPXG5EMPkwJ0Xr+kqNs2b4/:/+aCMvMGbRNEqSrVU0w0
TLSH
T136464A07F9A545E8C4AED634C6629263BE71BC485B3023D32B60F7786F76BD06A79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-27_75cf9cfbd4ccbe526aea1094cb4cf244_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 5.6MB
- SHA256 5c98cd8d65a54925a0ab3d826e57da8c4dcf1814228f705f895bfad2b3397c08
- MD5 75cf9cfbd4ccbe526aea1094cb4cf244
- SHA1 be286681d4281da0f0e7914dd1b5df7963e82229
- SHA512 98c714e1510c838e48b101769a290777b3881611abc8756720ad28a24b57a599756e9887d30e1eff9f6fea4db1044b2bb009509e7c2c79cb62ddcb0150a04d5d
- SSDEEP 49152:jQ3WprK5qFNQyjx+lMRJdlgMMG8baA28GbIMIOI2REPXG5EMPkwJ0Xr+kqNs2b4/:/+aCMvMGbRNEqSrVU0w0
- TLSH
  T136464A07F9A545E8C4AED634C6629263BE71BC485B3023D32B60F7786F76BD06A79700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution
- Looks for VirtualBox drivers on disk
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Looks for VMWare drivers on disk
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2