General
- Target 2026-10-28_2c6450b1a2d23b3f41099d6076bba37d_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 5.7MB
- Sample261030-jk35sadh39
- SHA256 83242870465a7b96caf9c2272b7040de7cc21be59621acae5ad2ad496a820a37
- MD5 2c6450b1a2d23b3f41099d6076bba37d
- SHA1 c5488ee3f7fb2cf6338ed256fd394e483e27bdcc
- SHA512 bbb9106c07f546f98b2997483ac765ec244710059b346de55b136676a1349ed34e4762be033abb43b218f3428df90aabb608f295c1fda9b109bc339248383340
- SSDEEP 49152:wNx5IyjhNVatpr2haPL+38+FhuZxyfEP5IHe7z8pAzjja5ERqvjVerRAdgBWyzlW:ohopNE8fZxdfqEMWRyYlo
- TLSH T1D3563947FC9545E9C0AED23186668263BA717C485F3163D72BA0F7382F76BD0AA78350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_2c6450b1a2d23b3f41099d6076bba37d_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-28_2c6450b1a2d23b3f41099d6076bba37d_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-28_2c6450b1a2d23b3f41099d6076bba37d_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 5.7MB
- SHA256 83242870465a7b96caf9c2272b7040de7cc21be59621acae5ad2ad496a820a37
- MD5 2c6450b1a2d23b3f41099d6076bba37d
- SHA1 c5488ee3f7fb2cf6338ed256fd394e483e27bdcc
- SHA512 bbb9106c07f546f98b2997483ac765ec244710059b346de55b136676a1349ed34e4762be033abb43b218f3428df90aabb608f295c1fda9b109bc339248383340
- SSDEEP 49152:wNx5IyjhNVatpr2haPL+38+FhuZxyfEP5IHe7z8pAzjja5ERqvjVerRAdgBWyzlW:ohopNE8fZxdfqEMWRyYlo
- TLSH T1D3563947FC9545E9C0AED23186668263BA717C485F3163D72BA0F7382F76BD0AA78350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1