General
- Target 2026-09-06_7f5a6c7cb33716bbaa13a9e0e7cd2627_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 13.4MB
- Sample260907-accs7aszay
- SHA256 236d5fafbca3746c3e3c0cba20fd4c070a9224f70ed4a895efe056402f38cbdf
Malware Config
Targets
-
- Target 2026-09-06_7f5a6c7cb33716bbaa13a9e0e7cd2627_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 13.4MB
- SHA256 236d5fafbca3746c3e3c0cba20fd4c070a9224f70ed4a895efe056402f38cbdf
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Uses browser remote debugging
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Authentication Process
1Modify Registry
2Subvert Trust Controls
3Install Root Certificate
2SIP and Trust Provider Hijacking
1