General
- Target 2026-11-01_8bd5a9cba88432f23b00708c077f6fe0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 5.5MB
- Sample261102-sspf2avtdx
- SHA256 865d2f25a390ccc00bd21d8c70f10ca62d34cd35839ded816580afbfedf5ee5b
- MD5 8bd5a9cba88432f23b00708c077f6fe0
- SHA1 25e362078779290f255dded2f49942891178282c
- SHA512 b6a6e2e4f42e8d588c8ec2fa339ed0c8416d887b05cc79b42add9239c2fdb79e2dbd2e273415a10ada12b79028337b2e195132a0ec978edfd214af060be2f31e
- SSDEEP 49152:tcbCLHkCH+91T9GVVgPwDLOUKC6xooum+3R24jw5ElyQu6XTkH8v3dwYLtoR1B4p:s0WAglooumZElTO63yLi
- TLSH T112464B57ED9546A8C0EED2318A7292527A717C485F3123D72F60F7382FB2BD06AB9344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_8bd5a9cba88432f23b00708c077f6fe0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Resource
win10v2004-20260911-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_8bd5a9cba88432f23b00708c077f6fe0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Resource
win11ltsc2024-20260911-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-01_8bd5a9cba88432f23b00708c077f6fe0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 5.5MB
- SHA256 865d2f25a390ccc00bd21d8c70f10ca62d34cd35839ded816580afbfedf5ee5b
- MD5 8bd5a9cba88432f23b00708c077f6fe0
- SHA1 25e362078779290f255dded2f49942891178282c
- SHA512 b6a6e2e4f42e8d588c8ec2fa339ed0c8416d887b05cc79b42add9239c2fdb79e2dbd2e273415a10ada12b79028337b2e195132a0ec978edfd214af060be2f31e
- SSDEEP 49152:tcbCLHkCH+91T9GVVgPwDLOUKC6xooum+3R24jw5ElyQu6XTkH8v3dwYLtoR1B4p:s0WAglooumZElTO63yLi
- TLSH T112464B57ED9546A8C0EED2318A7292527A717C485F3123D72F60F7382FB2BD06AB9344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.