General
- Target 2026-09-26_b70de86331806aaf750d3c17e2a03491_coinminer_dosia_elex_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 30.8MB
- Sample260926-tl2cpaws2q
- SHA256 c661f5ccf73bbb004a1ad5cd7e7d3c0e60ad6d62992413b61137e40886d8255f
- MD5 b70de86331806aaf750d3c17e2a03491
- SHA1 81a087c057dfa24c7ffa3c9182f34fcbe717ee6b
- SHA512 c8258082bd75e6b867c06e112de4a03e34fc924acbb4c88039a408061dfefa4fd690975fb14505a81a16af0b931887100f00121c92ebdfb55669ce9b2253d7c6
- SSDEEP 393216:eaCkHQfpL4Fisia7wpXrHAmKsYD/BTZpqnY1JJxG0uK9xlpJ:ejvyFF7wpbAm/Y1L/ocT
- TLSH T110679E06BB970CF5DCC22775699B232E5730FC109F198BABFB48B634A8632D45D2A750
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-26_b70de86331806aaf750d3c17e2a03491_coinminer_dosia_elex_frostygoop_glassworm_hive_luca-stea.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-26_b70de86331806aaf750d3c17e2a03491_coinminer_dosia_elex_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 30.8MB
- SHA256 c661f5ccf73bbb004a1ad5cd7e7d3c0e60ad6d62992413b61137e40886d8255f
- MD5 b70de86331806aaf750d3c17e2a03491
- SHA1 81a087c057dfa24c7ffa3c9182f34fcbe717ee6b
- SHA512 c8258082bd75e6b867c06e112de4a03e34fc924acbb4c88039a408061dfefa4fd690975fb14505a81a16af0b931887100f00121c92ebdfb55669ce9b2253d7c6
- SSDEEP 393216:eaCkHQfpL4Fisia7wpXrHAmKsYD/BTZpqnY1JJxG0uK9xlpJ:ejvyFF7wpbAm/Y1L/ocT
- TLSH T110679E06BB970CF5DCC22775699B232E5730FC109F198BABFB48B634A8632D45D2A750
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.