General
- Target 2026-08-17_077124b02fa726423c86b0ab4960553a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 7.1MB
- Sample260817-2vmjws1fjb
- SHA256 b3a40a38e3168bb9c39aa51214d046d35f824bea354ec75295c36d7a26fbac2e
Score
8/10
Malware Config
Targets
-
- Target 2026-08-17_077124b02fa726423c86b0ab4960553a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 7.1MB
- SHA256 b3a40a38e3168bb9c39aa51214d046d35f824bea354ec75295c36d7a26fbac2e
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Uses browser remote debugging
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
-
Executes dropped EXE
-
Adds Run key to start application
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Modify Authentication Process
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Authentication Process
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2