Overview

overview

8

Static

static

7

2026-10-25...rm.exe

windows10-2004-x64

8

2026-10-25...rm.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-10-25_c5319c0c1e36a1495bacc6813eb0e653_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm_hive_icedid_lorenz_njrat_poet-rat_salatstealer_sliver_snatch_vidar
  • Size 16.7MB
  • Sample261026-qargkabb53
  • SHA256 8b38cc76dfe6dfaa0abfbce5744ad49885ee127b7fff6e519d50fe17b26c3f7c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordefense_evasiondiscoveryexecutionhacktoolproxytunnel

Malware Config

Targets

    • Target
      2026-10-25_c5319c0c1e36a1495bacc6813eb0e653_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm_hive_icedid_lorenz_njrat_poet-rat_salatstealer_sliver_snatch_vidar
    • Size 16.7MB
    • SHA256 8b38cc76dfe6dfaa0abfbce5744ad49885ee127b7fff6e519d50fe17b26c3f7c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    backdoordefense_evasiondiscoveryexecutionhacktoolproxytunnel

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Modifies file permissions

      discovery

    • Reverse proxy tool: Chisel

      Chisel can be used to bypass network security and establish persistent backdoors. This open-source utility tunnels traffic through a public server to expose internal services behind NAT or firewalls.

      hacktooltunnelproxybackdoor

    • Stops running service(s)

      defense_evasionexecution

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks