31fc078b4b88b3b7f5665dc455eebd3501c1f3d69433228a9d907e42d10c74b5

General

Target
2026-09-29_15cb786b8f06878e81f6072eb3749d07_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 5.6MB
Sample260930-fs2edavvcy
SHA256 31fc078b4b88b3b7f5665dc455eebd3501c1f3d69433228a9d907e42d10c74b5
MD5 15cb786b8f06878e81f6072eb3749d07
SHA1 3fe8c87045b1036f65b4e0afe264604f6b1835d9
SHA512 b5ead404502be1918e777deaef4013612924144d72ec4f10cdfd63b52dbfae2fe7c807ff8181b0972553ef4acddfbce34902fd54c36621117d2e0ba51564dd5c
SSDEEP 49152:2Q3WprK5qFNQyjx+lMRJdlgMMG8baA28GbIMIOI2REPXG5EMPKwJ0Xr+kqNs2b41:0+aCMvMGbRNEASrVU0wZQ
TLSH
T139464A07F9A545E8C4AED634C6629263BE71BC485B3023D32B60F7786F76BD06A79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-29_15cb786b8f06878e81f6072eb3749d07_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 5.6MB
- SHA256 31fc078b4b88b3b7f5665dc455eebd3501c1f3d69433228a9d907e42d10c74b5
- MD5 15cb786b8f06878e81f6072eb3749d07
- SHA1 3fe8c87045b1036f65b4e0afe264604f6b1835d9
- SHA512 b5ead404502be1918e777deaef4013612924144d72ec4f10cdfd63b52dbfae2fe7c807ff8181b0972553ef4acddfbce34902fd54c36621117d2e0ba51564dd5c
- SSDEEP 49152:2Q3WprK5qFNQyjx+lMRJdlgMMG8baA28GbIMIOI2REPXG5EMPKwJ0Xr+kqNs2b41:0+aCMvMGbRNEASrVU0wZQ
- TLSH
  T139464A07F9A545E8C4AED634C6629263BE71BC485B3023D32B60F7786F76BD06A79700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution
- Looks for VirtualBox drivers on disk
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Looks for VMWare drivers on disk
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2