General
- Target 2026-08-11_c741b97744bd2739a24a088754d125fe_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 5.8MB
- Sample260811-hgl7esyake
- SHA256 b8456798fab4befb98eab06214dd08dca9c798812cacb03d0ed8da295ea17dce
- MD5 c741b97744bd2739a24a088754d125fe
- SHA1 a019046f7685815e5fe32d078fb94487b4232073
- SHA512 aa4e3a90a146d6f8b7d4f5518de131aa5bc34bcbadbc33cc9ad567079df151e65e0572ffa5be5fbbac0a0d125764120c577140f7d04eb48cda209048e7395b56
- SSDEEP 49152:Yi8Ozyr7jadCGMvLWtwf0UlTFwSIkQUfw0BfmIeOak93Ln6ElsjVPXA8cUODdn2x:YYQDBfqDkf71dxdEV
- TLSH T1C5564B07ECA554E9C0AEE13586279263BA717C885B3123D73B90F7282F727E06EB5750
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-11_c741b97744bd2739a24a088754d125fe_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-08-11_c741b97744bd2739a24a088754d125fe_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-08-11_c741b97744bd2739a24a088754d125fe_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 5.8MB
- SHA256 b8456798fab4befb98eab06214dd08dca9c798812cacb03d0ed8da295ea17dce
- MD5 c741b97744bd2739a24a088754d125fe
- SHA1 a019046f7685815e5fe32d078fb94487b4232073
- SHA512 aa4e3a90a146d6f8b7d4f5518de131aa5bc34bcbadbc33cc9ad567079df151e65e0572ffa5be5fbbac0a0d125764120c577140f7d04eb48cda209048e7395b56
- SSDEEP 49152:Yi8Ozyr7jadCGMvLWtwf0UlTFwSIkQUfw0BfmIeOak93Ln6ElsjVPXA8cUODdn2x:YYQDBfqDkf71dxdEV
- TLSH T1C5564B07ECA554E9C0AEE13586279263BA717C885B3123D73B90F7282F727E06EB5750
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Disables use of System Restore points
-
Disables service(s)
-
Stops running service(s)
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1System Services
2Service Execution
2Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Indicator Removal
3File Deletion
3Obfuscated Files or Information
1Command Obfuscation
1