General
- Target 2026-11-01_ca29d255b8cad6953b280a0d9b8254e8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch_zxxz
- Size 25.2MB
- Sample261102-kn5y8atz2m
- SHA256 f0bb15897f614e1ca5b8df08b580881667eacba4c493fc9a0cf9dd8276f711c2
- MD5 ca29d255b8cad6953b280a0d9b8254e8
- SHA1 9dcdae35b6b9c22d0ead5e9854b71e08d5834071
- SHA512 ab161cb542f4c2b1e92f0a9533044b78c7de49435487266cb283b38227bd855e96769eec587feb2ece5d0860048ffdb03b4d79fdac400547e7873bfa7c467d76
- SSDEEP 98304:/VcRAHXVCvBjvnG0eUvJOW47dpT9X58jYQEhtHsnW4BehXgTzw8gRFu2bPT64skx:/V6AMBjvGnUv8Wmv6RaXAJgH/skNOM3
- TLSH T14F476B83A6E645E0D2EEE134C9369553BA703C6A4F2163CB1B64F6252F73BD06E39740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-11-01_ca29d255b8cad6953b280a0d9b8254e8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Resource
win10v2004-20260911-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_ca29d255b8cad6953b280a0d9b8254e8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Resource
win11ltsc2024-20260911-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-01_ca29d255b8cad6953b280a0d9b8254e8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch_zxxz
- Size 25.2MB
- SHA256 f0bb15897f614e1ca5b8df08b580881667eacba4c493fc9a0cf9dd8276f711c2
- MD5 ca29d255b8cad6953b280a0d9b8254e8
- SHA1 9dcdae35b6b9c22d0ead5e9854b71e08d5834071
- SHA512 ab161cb542f4c2b1e92f0a9533044b78c7de49435487266cb283b38227bd855e96769eec587feb2ece5d0860048ffdb03b4d79fdac400547e7873bfa7c467d76
- SSDEEP 98304:/VcRAHXVCvBjvnG0eUvJOW47dpT9X58jYQEhtHsnW4BehXgTzw8gRFu2bPT64skx:/V6AMBjvGnUv8Wmv6RaXAJgH/skNOM3
- TLSH T14F476B83A6E645E0D2EEE134C9369553BA703C6A4F2163CB1B64F6252F73BD06E39740
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks whether UAC is enabled
Uses WMI to collect hardware manufacturer information
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Virtualization/Sandbox Evasion
1System Checks
1