General
- Target 2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.7MB
- Sample260903-2k8dlsxdla
- SHA256 87b9bcfe0669495f1c149aafa02ed8ae459834314a6f6c140a0b628c959e29b4
Malware Config
Targets
-
- Target 2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.7MB
- SHA256 87b9bcfe0669495f1c149aafa02ed8ae459834314a6f6c140a0b628c959e29b4
Score9/10Clears Windows event logs
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Uses browser remote debugging
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Executes dropped EXE
Adds Run key to start application
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1Clear Windows Event Logs
1Modify Authentication Process
1Modify Registry
2