vryxen | 2026-03-16_1f44dd6ce3e8e68e95d4c5e2317dd237_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-03-16_1f44dd6ce3e8e68e95d4c5e2317dd237_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
Size 10.8MB
Sample260316-e2qhssct71
SHA256 82442409a93cdadb106e89e144882332fed0e27820db6bca62641e44f2531291
MD5 1f44dd6ce3e8e68e95d4c5e2317dd237
SHA1 f819e23de84df4b16156bce38a0ffd0eb7af1cde
SHA512 e2b87a36e28dd1ed321d12b131e3e26470112ec28c7278432edfd7a21ef815fa73c42db81ed4338f7d1c1b43ce299502dd2ae7507f256b1676206657f82fa73d
SSDEEP 98304:GFPEgZ0E4GFlXcfWtE7gpJYEIc+L6Et54k7IaumvBh8huT1E:GqcKGMaIntmk7C
TLSH
T1FFB63A47ECA555E5C0AEC175CA369512BAB13C884B3523D32B90FB252F37BD0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

vryxen

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects Vryxen stealer 1 IoCs

resource	yara_rule
sample	family_vryxen

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Vryxen family
vryxen

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-16_1f44dd6ce3e8e68e95d4c5e2317dd237_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch

File Explorer

2026-03-16_1f44dd6ce3e8e68e95d4c5e2317dd237_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch

.exe 10.8MB

2026-03-16_1f44dd6ce3e8e68e95d4c5e2317dd237_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 82442409a93cdadb106e89e144882332fed0e27820db6bca62641e44f2531291
MD5 1f44dd6ce3e8e68e95d4c5e2317dd237
SHA1 f819e23de84df4b16156bce38a0ffd0eb7af1cde
SHA512 e2b87a36e28dd1ed321d12b131e3e26470112ec28c7278432edfd7a21ef815fa73c42db81ed4338f7d1c1b43ce299502dd2ae7507f256b1676206657f82fa73d
SSDEEP 98304:GFPEgZ0E4GFlXcfWtE7gpJYEIc+L6Et54k7IaumvBh8huT1E:GqcKGMaIntmk7C
TLSH
T1FFB63A47ECA555E5C0AEC175CA369512BAB13C884B3523D32B90FB252F37BD0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects Vryxen stealer
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

556992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.8MB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

496KB

Virtual Size

32.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

178KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

2026-03-16_1f44dd6ce3e8e68e95d4c5e2317dd237_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch

kernel32

generic