Overview

overview

10

Static

static

10

2026-11-06...ar.exe

windows10-2004-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-11-06_ff0166d0bf0607ca8fac3135e79ff2c9_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar
  • Size 11.4MB
  • Sample261107-v81kcafe48
  • SHA256 0f81d1343c6427d346983ff3c0a7926a25844e11a832ff3202fcef08a1adf651
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistencespywaretrojan

Malware Config

Targets

    • Target
      2026-11-06_ff0166d0bf0607ca8fac3135e79ff2c9_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar
    • Size 11.4MB
    • SHA256 0f81d1343c6427d346983ff3c0a7926a25844e11a832ff3202fcef08a1adf651
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoveryexecutionpersistencespywaretrojan

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Uses WMI to collect hardware manufacturer information

      Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks