c6b637ad83fdd875407d5a2615f336175666e518dabd3d6a8822de623ff1bee6

General

Target
2026-10-17_a4ba22e1154f42c55deafcfd7263da28_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch
Size 11.3MB
Sample261018-2cdt2abt51
SHA256 c6b637ad83fdd875407d5a2615f336175666e518dabd3d6a8822de623ff1bee6
MD5 a4ba22e1154f42c55deafcfd7263da28
SHA1 4c014ddac1d95af42dfcbb55998e8d6a045e99a9
SHA512 7b362eece0c3806b67841075723584eea551c074330540efbf5abc3efbe812a33ab46375f0053451bdbfee070f0dcf56c8deb1335c39f003cec9445fe5701243
SSDEEP 196608:+fuJI5gpuXnKZOEtqaRvmvBSwCoxv3VT7M/:+Gk2pMaRO2m/9M
TLSH
T182C63850FACB55F1EA03587261ABB23F13341E058B25DBC7EB447F6AE937A911833246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-17_a4ba22e1154f42c55deafcfd7263da28_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch
- Size 11.3MB
- SHA256 c6b637ad83fdd875407d5a2615f336175666e518dabd3d6a8822de623ff1bee6
- MD5 a4ba22e1154f42c55deafcfd7263da28
- SHA1 4c014ddac1d95af42dfcbb55998e8d6a045e99a9
- SHA512 7b362eece0c3806b67841075723584eea551c074330540efbf5abc3efbe812a33ab46375f0053451bdbfee070f0dcf56c8deb1335c39f003cec9445fe5701243
- SSDEEP 196608:+fuJI5gpuXnKZOEtqaRvmvBSwCoxv3VT7M/:+Gk2pMaRO2m/9M
- TLSH
  T182C63850FACB55F1EA03587261ABB23F13341E058B25DBC7EB447F6AE937A911833246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery persistence privilege_escalation spyware stealer trojan
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables Discord URL observed in first stage droppers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing URLs to raw contents of a Github gist
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1