General
- Target 2026-10-01_76d92ec5ff5502867ccb063ab99896db_coinminer_dosia_elex_glassworm_luca-stealer_poet-rat_quasar-rat_remcos_wannacry
- Size 9.8MB
- Sample261002-nq2alattft
- SHA256 82432ba9a2e70f6da9a5c77293a735cbc72896ec305eb00034ac756e6d7a47a0
Score
10/10
Malware Config
Targets
-
- Target 2026-10-01_76d92ec5ff5502867ccb063ab99896db_coinminer_dosia_elex_glassworm_luca-stealer_poet-rat_quasar-rat_remcos_wannacry
- Size 9.8MB
- SHA256 82432ba9a2e70f6da9a5c77293a735cbc72896ec305eb00034ac756e6d7a47a0
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
-
Detects executables packed with Themida
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Debugger Evasion
1Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1