Overview

overview

8

Static

static

7

2026-11-07...rm.exe

windows10-2004-x64

8

2026-11-07...rm.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm_hive_icedid_lorenz_njrat_poet-rat_salatstealer_sliver_snatch_vidar
  • Size 16.7MB
  • Sample261108-c2c7cshs9x
  • SHA256 7df6f8ba20cd8711eb82deae2a17d5def92fcf77e48ef0a0df0e7106258dab16
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordefense_evasiondiscoveryexecutionhacktoolproxytunnel

Malware Config

Targets

    • Target
      2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm_hive_icedid_lorenz_njrat_poet-rat_salatstealer_sliver_snatch_vidar
    • Size 16.7MB
    • SHA256 7df6f8ba20cd8711eb82deae2a17d5def92fcf77e48ef0a0df0e7106258dab16
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    backdoordefense_evasiondiscoveryexecutionhacktoolproxytunnel

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Modifies file permissions

      discovery

    • Reverse proxy tool: Chisel

      Chisel can be used to bypass network security and establish persistent backdoors. This open-source utility tunnels traffic through a public server to expose internal services behind NAT or firewalls.

      hacktooltunnelproxybackdoor

    • Stops running service(s)

      defense_evasionexecution

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks