General
- Target 2026-07-18_502af544ecd10f5dc3dcf1ddc9d8437b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 29.3MB
- Sample260718-bf6q4se19w
- SHA256 908ac6c4d6ada00f066140c2cfb4d828454b340c4e7c60cbf54d30a71614aba1
Malware Config
Targets
-
- Target 2026-07-18_502af544ecd10f5dc3dcf1ddc9d8437b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 29.3MB
- SHA256 908ac6c4d6ada00f066140c2cfb4d828454b340c4e7c60cbf54d30a71614aba1
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Drops file in Drivers directory
-
Drops startup file
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
2Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2