General
- Target 2026-08-20_d1a71d9ee236b32cc258f2e2434daa9a_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 9.5MB
- Sample260820-vkhdvs1glc
- SHA256 d553d05102eee99c4b24109bdfd146cf0251e86d6ef9c6e303e4bbcbf905967d
- MD5 d1a71d9ee236b32cc258f2e2434daa9a
- SHA1 2b5c86ea84c9a5e8975c23a7a379ce8d6d21da55
- SHA512 37d7fce7cbfd39168bd7b5bcb3045c3e14a595fd4d4bd61cc5f31a6db263e8843a28ec6579d968174f74a7ff30d2b4113fafb773b6d9889cc9ccb9e25b1d2c61
- SSDEEP 98304:vwwQ/L16gNCfO+3CN2q1+rlmIg4K7F68+W97QZmjJiteEI:gcgNgqKQmK7F6o7sb
- TLSH T1F4A63941EEDB81F2F9031931815BB26F22346D059B24CFD7EB407FAAF877A951936206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-20_d1a71d9ee236b32cc258f2e2434daa9a_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_d1a71d9ee236b32cc258f2e2434daa9a_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe
Resource
win11ltsc2024-20260709-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_d1a71d9ee236b32cc258f2e2434daa9a_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 9.5MB
- SHA256 d553d05102eee99c4b24109bdfd146cf0251e86d6ef9c6e303e4bbcbf905967d
- MD5 d1a71d9ee236b32cc258f2e2434daa9a
- SHA1 2b5c86ea84c9a5e8975c23a7a379ce8d6d21da55
- SHA512 37d7fce7cbfd39168bd7b5bcb3045c3e14a595fd4d4bd61cc5f31a6db263e8843a28ec6579d968174f74a7ff30d2b4113fafb773b6d9889cc9ccb9e25b1d2c61
- SSDEEP 98304:vwwQ/L16gNCfO+3CN2q1+rlmIg4K7F68+W97QZmjJiteEI:gcgNgqKQmK7F6o7sb
- TLSH T1F4A63941EEDB81F2F9031931815BB26F22346D059B24CFD7EB407FAAF877A951936206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2