Overview

overview

7

Static

static

3

2026-10-22...ch.exe

windows10-2004-x64

7

2026-10-22...ch.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-10-22_a5e866fabe25cbbca1ea01877b95a155_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
  • Size 33.5MB
  • Sample261024-b9mkbse16t
  • SHA256 ac63ce6bff5ccc9e372398089751f41afadf40e1b34c0e42be597993114f3fad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistence

Malware Config

Targets

    • Target
      2026-10-22_a5e866fabe25cbbca1ea01877b95a155_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
    • Size 33.5MB
    • SHA256 ac63ce6bff5ccc9e372398089751f41afadf40e1b34c0e42be597993114f3fad
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasiondiscoveryexecutionpersistence

    • Executes dropped EXE

    • Uses WMI to collect hardware manufacturer information

      Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

      defense_evasion

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks