General
- Target 2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.7MB
- Sample260903-2k8dlsxdla
- SHA256 87b9bcfe0669495f1c149aafa02ed8ae459834314a6f6c140a0b628c959e29b4
Malware Config
Targets
-
- Target 2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.7MB
- SHA256 87b9bcfe0669495f1c149aafa02ed8ae459834314a6f6c140a0b628c959e29b4
Score9/10-
Clears Windows event logs
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Uses browser remote debugging
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Adds Run key to start application
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1Clear Windows Event Logs
1Modify Authentication Process
1Modify Registry
2