4790c66fd4d011d8798ba1be221179188b4539c2968174d9ccc0abaa42381b24

General

Target
2026-10-02_4fd12d75811edbf979970704224a42d9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 5.6MB
Sample261003-p3txqazyev
SHA256 4790c66fd4d011d8798ba1be221179188b4539c2968174d9ccc0abaa42381b24
MD5 4fd12d75811edbf979970704224a42d9
SHA1 30e336982920d5c3dfa4b871751944f0683b8030
SHA512 9d3cfdf7330605141331733b8dae051078fb6a894cdaa65732695df38ff05aa24f84345915345d22482adfc232fa1206e69f02d22dcad0810080a500cc862aba
SSDEEP 49152:KQ3WprK5qFNQyjx+lMRJdlgMMG8baA28GbIMIOI2REPXG5EMPwwJ0Xr+kqNs2b4G:I+aCMvMGbRNEySrVU0wF
TLSH
T1AF464A07F9A545E8C4AED634C6629263BE71BC485B3023D32B60F7786F76BD06A79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-02_4fd12d75811edbf979970704224a42d9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 5.6MB
- SHA256 4790c66fd4d011d8798ba1be221179188b4539c2968174d9ccc0abaa42381b24
- MD5 4fd12d75811edbf979970704224a42d9
- SHA1 30e336982920d5c3dfa4b871751944f0683b8030
- SHA512 9d3cfdf7330605141331733b8dae051078fb6a894cdaa65732695df38ff05aa24f84345915345d22482adfc232fa1206e69f02d22dcad0810080a500cc862aba
- SSDEEP 49152:KQ3WprK5qFNQyjx+lMRJdlgMMG8baA28GbIMIOI2REPXG5EMPwwJ0Xr+kqNs2b4G:I+aCMvMGbRNEySrVU0wF
- TLSH
  T1AF464A07F9A545E8C4AED634C6629263BE71BC485B3023D32B60F7786F76BD06A79700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution
- Looks for VirtualBox drivers on disk
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Looks for VMWare drivers on disk
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Uses WMI to collect hardware manufacturer information
  Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2