General
- Target 2026-07-01_1508c7d2ff896366afc57a2bec097003_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 5.8MB
- Sample260702-apvvjagx5m
- SHA256 bd8594c7c313fe0a52a546b445b85973d10111c92aa8cf2c897217d7e71d1134
Score
10/10
Malware Config
Targets
-
- Target 2026-07-01_1508c7d2ff896366afc57a2bec097003_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 5.8MB
- SHA256 bd8594c7c313fe0a52a546b445b85973d10111c92aa8cf2c897217d7e71d1134
Score10/10Detects DonutLoader
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
XMRig Miner payload
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Downloads MZ/PE file
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Suspicious use of SetThreadContext
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.