General
- Target 2026-09-26_7dc80831a8964f66b60c20914d7ffc52_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 11.5MB
- Sample260926-yncjkazz7l
- SHA256 2bc3f2a7b76108e5b99e7fbbeef00ffbbfaf89073162a62e20f88916929f5f23
Score
10/10
Malware Config
Targets
-
- Target 2026-09-26_7dc80831a8964f66b60c20914d7ffc52_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 11.5MB
- SHA256 2bc3f2a7b76108e5b99e7fbbeef00ffbbfaf89073162a62e20f88916929f5f23
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
detects Windows exceutables potentially bypassing UAC (ab)using Environment Variables in Scheduled T
-
Executes dropped EXE
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.