d90fb63dd0d5e80e92236ebbb61b6f0f2e9823a4889060f8c59487102287787d

General

Target
2026-09-29_2d804dbbe78392554fbb5dc036a1a97a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 5.6MB
Sample260930-d99e7svckd
SHA256 d90fb63dd0d5e80e92236ebbb61b6f0f2e9823a4889060f8c59487102287787d
MD5 2d804dbbe78392554fbb5dc036a1a97a
SHA1 f70c3d5c71d5abd5b1e932169c0a23473128ebd0
SHA512 0179895e579a1ec247864a4b5c5e84c312c5881500e3921f76a67132e0cb4440a7e2fdc3f613030a181a9b9273b1ca07a66a568a455091ff5045a44f24041a11
SSDEEP 49152:JQ3WprK5qFNQyjx+lMRJdlgMMG8baA28GbIMIOI2REPXG5EMPcwJ0Xr+kqNs2b4X:J+aCMvMGbRNEKSrVU0wQ
TLSH
T1B9464A07F9A545E8C4AED634C6629263BE71BC485B3023D32B60F7786F76BD06A79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-29_2d804dbbe78392554fbb5dc036a1a97a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 5.6MB
- SHA256 d90fb63dd0d5e80e92236ebbb61b6f0f2e9823a4889060f8c59487102287787d
- MD5 2d804dbbe78392554fbb5dc036a1a97a
- SHA1 f70c3d5c71d5abd5b1e932169c0a23473128ebd0
- SHA512 0179895e579a1ec247864a4b5c5e84c312c5881500e3921f76a67132e0cb4440a7e2fdc3f613030a181a9b9273b1ca07a66a568a455091ff5045a44f24041a11
- SSDEEP 49152:JQ3WprK5qFNQyjx+lMRJdlgMMG8baA28GbIMIOI2REPXG5EMPcwJ0Xr+kqNs2b4X:J+aCMvMGbRNEKSrVU0wQ
- TLSH
  T1B9464A07F9A545E8C4AED634C6629263BE71BC485B3023D32B60F7786F76BD06A79700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution
- Looks for VirtualBox drivers on disk
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Looks for VMWare drivers on disk
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2