General
- Target 2026-11-10_b958626c4a720955ea38b0c090f20148_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 5.6MB
- Sample261110-gdatjsgw9t
- SHA256 df0db8beeff79ebee6530c76fb03354f0d99e9141efeefefbe73a0e546be6a28
Malware Config
Targets
-
- Target 2026-11-10_b958626c4a720955ea38b0c090f20148_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 5.6MB
- SHA256 df0db8beeff79ebee6530c76fb03354f0d99e9141efeefefbe73a0e546be6a28
Score9/10Looks for VirtualBox drivers on disk
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information as a root user.
Looks for VMWare drivers on disk
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
Network Service Discovery
Attempt to gather information on host's network.
Uses WMI to collect hardware manufacturer information
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Windows Command Shell
1Windows Management Instrumentation
2Defense Evasion
Modify Registry
1Virtualization/Sandbox Evasion
3System Checks
1Discovery
File and Directory Discovery
2Network Service Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
3System Information Discovery
6System Network Configuration Discovery
1System Service Discovery
1Virtualization/Sandbox Evasion
3System Checks
1