General
- Target 2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 11.3MB
- Sample260708-e9yjdabx2q
- SHA256 34ad97945a1f70cdbf8af7777a6c71c990d841840cf3c94a387f6cc83450ad4b
- MD5 50cf5b4eb0b43d08455a381b05f4a4d3
- SHA1 63000ff3aa0958801d3549446c7853f0d0223bcf
- SHA512 327fca67c87a87a92b5b109ea32fefe4fcf786259a14096d5d92f2791c3dbe5b007f032d4f08a6e665302221887dda471bfcb3a6985f8eb30e2374ec89ebb75e
- SSDEEP 98304:7r92T1ylvBQ8cCdFGp24tpXMwOHzO6iMwESD:7x2TAhy8cbQzMa
- TLSH T125C63A47E8A145E8C0AEE535CA629213BE717C885B3423D72B50F7643F36BD0AEB9714
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
5 signatures
Behavioral task
behavioral1
Sample
2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Resource
win11ltsc2024-20260706-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 11.3MB
- SHA256 34ad97945a1f70cdbf8af7777a6c71c990d841840cf3c94a387f6cc83450ad4b
- MD5 50cf5b4eb0b43d08455a381b05f4a4d3
- SHA1 63000ff3aa0958801d3549446c7853f0d0223bcf
- SHA512 327fca67c87a87a92b5b109ea32fefe4fcf786259a14096d5d92f2791c3dbe5b007f032d4f08a6e665302221887dda471bfcb3a6985f8eb30e2374ec89ebb75e
- SSDEEP 98304:7r92T1ylvBQ8cCdFGp24tpXMwOHzO6iMwESD:7x2TAhy8cbQzMa
- TLSH T125C63A47E8A145E8C0AEE535CA629213BE717C885B3423D72B50F7643F36BD0AEB9714
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1