2026-05-23_9848723c4a5c1af119f20b32cb260f11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-23_9848723c4a5c1af119f20b32cb260f11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 10.5MB
Sample260523-dmv93aev2s
SHA256 cfbe2c12ff73eb7184f910d0edd6d98697967ef6aecaa614517337498d6c7857
MD5 9848723c4a5c1af119f20b32cb260f11
SHA1 45e3dd7737063233d624c3271173f4f537623aad
SHA512 1efb46cca15c9f69e886dc59931cfb7692bab773996d751482242c408b055b1aedda3b6dd5409357b76f7c6ee108208bf1a24e1601f938a3ffcc1e9bc1424103
SSDEEP 49152:8vrRk0BREt6/RQi/aeVwwk0LZxQN3R5w1Dorbb/umnl2HRCUNbawlRgSqiVZTouE:8vCciiK3RFw7tX9P5OExHr09UE
TLSH
T153B63A4BE8B545E5C1AED176CA369512BF713C884B2063D76B50F6242F37BE0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-23_9848723c4a5c1af119f20b32cb260f11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-05-23_9848723c4a5c1af119f20b32cb260f11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 10.5MB

2026-05-23_9848723c4a5c1af119f20b32cb260f11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 cfbe2c12ff73eb7184f910d0edd6d98697967ef6aecaa614517337498d6c7857
MD5 9848723c4a5c1af119f20b32cb260f11
SHA1 45e3dd7737063233d624c3271173f4f537623aad
SHA512 1efb46cca15c9f69e886dc59931cfb7692bab773996d751482242c408b055b1aedda3b6dd5409357b76f7c6ee108208bf1a24e1601f938a3ffcc1e9bc1424103
SSDEEP 49152:8vrRk0BREt6/RQi/aeVwwk0LZxQN3R5w1Dorbb/umnl2HRCUNbawlRgSqiVZTouE:8vCciiK3RFw7tX9P5OExHr09UE
TLSH
T153B63A4BE8B545E5C1AED176CA369512BF713C884B2063D76B50F6242F37BE0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

557312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

489KB

Virtual Size

32.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-05-23_9848723c4a5c1af119f20b32cb260f11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic