Extracted

• • Target
    2026-05-22_183f5c410c8b346318b6fc6796d09bf5_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
  • Size 12.4MB
  • SHA256 3b1d62dfdc972debb015b3d86bc7ae1eff4d6a63a546a8300501bd0914d0f1fc
  • MD5 183f5c410c8b346318b6fc6796d09bf5
  • SHA1 2c657ef2a2bc69bdb626929db65b0ec1f251127d
  • SHA512 b3c90ee90d1f3345bcb76bede7272efbad9e69a2434aff3aa2cbdc85e695c37a760cf8d740a24249f6f3e6f8091de7dab41cc65489ae77e3b58dfad3c9dbd6e0
  • SSDEEP 98304:RG7S26mnXTGpuTw/wCl7WZoRjzFG2wDMjdYPFp9zE:RGxPXK1WZoRjzFpwDMjy9p9g
  • TLSH
    T1EFD65C07FC9454E5C4AEC1358A7296227B717C490B3123D72BA4BA282F77BE4AD7D384
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdiscoverypersistenceprivilege_escalationspywarestealer

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Drops startup file

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer
  behavioral1behavioral2