General
- Target 2026-10-02_6017ae555cebaa82f27b9b4a7eda9929_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 5.6MB
- Sample261003-nqa4eays3q
- SHA256 5ea77558436c733c044e3496baed7ce6db5a45f70e4c497c3cf313a5b41518fd
Malware Config
Targets
-
- Target 2026-10-02_6017ae555cebaa82f27b9b4a7eda9929_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 5.6MB
- SHA256 5ea77558436c733c044e3496baed7ce6db5a45f70e4c497c3cf313a5b41518fd
Score9/10-
Looks for VirtualBox drivers on disk
-
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information as a root user.
-
Looks for VMWare drivers on disk
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Uses WMI to collect hardware manufacturer information
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Windows Command Shell
1Windows Management Instrumentation
2Defense Evasion
Modify Registry
1Virtualization/Sandbox Evasion
3System Checks
1Discovery
File and Directory Discovery
2Network Service Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
4System Information Discovery
7System Network Configuration Discovery
1Virtualization/Sandbox Evasion
3System Checks
1