General
- Target 2026-08-05_640ef4f9ed77b1070a91312bd05871fe_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 27.5MB
- Sample260806-akrbjsam7v
- SHA256 cbcec3710f2d83b465151192fa263a6d8b0fe8a240aa144158ea19bd04d9f0fa
- MD5 640ef4f9ed77b1070a91312bd05871fe
- SHA1 11c7ada474e695f3b1d56187e024825d56609fa8
- SHA512 7a2884c84278b4e487523b7e6a36ff164e8ad1c46bed48e170cdd4d5ea221e7c96c6bef5ec992f028476556a230ff22ba622608b105f3bdd7b69a4473956944e
- SSDEEP 196608:NVMwtY28ObR6IIIeMpFpsNWaUawTx6ptjp+egCgIliAs4n:N+WY2JboIDeYYptjjFgrk
- TLSH T1F2575B47F86508E5C5EAC530846662127B727C494B3127D72B64F7382FBABD0AFBA350
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-05_640ef4f9ed77b1070a91312bd05871fe_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_640ef4f9ed77b1070a91312bd05871fe_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-05_640ef4f9ed77b1070a91312bd05871fe_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 27.5MB
- SHA256 cbcec3710f2d83b465151192fa263a6d8b0fe8a240aa144158ea19bd04d9f0fa
- MD5 640ef4f9ed77b1070a91312bd05871fe
- SHA1 11c7ada474e695f3b1d56187e024825d56609fa8
- SHA512 7a2884c84278b4e487523b7e6a36ff164e8ad1c46bed48e170cdd4d5ea221e7c96c6bef5ec992f028476556a230ff22ba622608b105f3bdd7b69a4473956944e
- SSDEEP 196608:NVMwtY28ObR6IIIeMpFpsNWaUawTx6ptjp+egCgIliAs4n:N+WY2JboIDeYYptjjFgrk
- TLSH T1F2575B47F86508E5C5EAC530846662127B727C494B3127D72B64F7382FBABD0AFBA350
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Adds Run key to start application
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1