7c8ad56f4637dff2211b0e332d11d144c100d5a2d1e212a9a2774b83e19bdff3

General

Target
2026-10-01_51b2ae20b9f79792e6e4ecafa812115a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 5.6MB
Sample261003-zkncbsythy
SHA256 7c8ad56f4637dff2211b0e332d11d144c100d5a2d1e212a9a2774b83e19bdff3
MD5 51b2ae20b9f79792e6e4ecafa812115a
SHA1 be82fa51f34c6b7d31564f9b44afe345ab318b91
SHA512 a1581942fc9bc45d677da20917ac02d14132cb3e1fdbdbfed2fc317b01519c4003a914ee5863c0a0979625b57a4f3eb26d834e308e67572fa395ab73a49cddce
SSDEEP 49152:1QTKh1KNl3Qc21+r18p95lMFms7aAJvG4oo0Ocy6kPXG5EMPUwJ0Xr+kqNs275wY:d+KjMY4G4tUEqSrVUlwY
TLSH
T186464A07F9A545E8C4AED634C6629263BE71BC485B3023D32B60F7786F76BD06A79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-01_51b2ae20b9f79792e6e4ecafa812115a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 5.6MB
- SHA256 7c8ad56f4637dff2211b0e332d11d144c100d5a2d1e212a9a2774b83e19bdff3
- MD5 51b2ae20b9f79792e6e4ecafa812115a
- SHA1 be82fa51f34c6b7d31564f9b44afe345ab318b91
- SHA512 a1581942fc9bc45d677da20917ac02d14132cb3e1fdbdbfed2fc317b01519c4003a914ee5863c0a0979625b57a4f3eb26d834e308e67572fa395ab73a49cddce
- SSDEEP 49152:1QTKh1KNl3Qc21+r18p95lMFms7aAJvG4oo0Ocy6kPXG5EMPUwJ0Xr+kqNs275wY:d+KjMY4G4tUEqSrVUlwY
- TLSH
  T186464A07F9A545E8C4AED634C6629263BE71BC485B3023D32B60F7786F76BD06A79700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution
- Looks for VirtualBox drivers on disk
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Looks for VMWare drivers on disk
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Uses WMI to collect hardware manufacturer information
  Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2