General
- Target 2026-09-04_4482e2dd95fa7dc3fffaa1d43a0ec396_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.7MB
- Sample260905-prmz2acm2t
- SHA256 9b5dd26339b05147983c25f35e4808aea85c9ef77e7413319ed2ddbcf51bacd8
Malware Config
Targets
-
- Target 2026-09-04_4482e2dd95fa7dc3fffaa1d43a0ec396_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.7MB
- SHA256 9b5dd26339b05147983c25f35e4808aea85c9ef77e7413319ed2ddbcf51bacd8
Score9/10-
Clears Windows event logs
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Uses browser remote debugging
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Adds Run key to start application
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1Clear Windows Event Logs
1Modify Authentication Process
1Modify Registry
2