2026-06-04_d6943973b1901817751cc603f1d1c156_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-04_d6943973b1901817751cc603f1d1c156_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 12.4MB
Sample260604-bcnfcshv7m
SHA256 9cd4ad010e1d3ff5c00eb1edf0995af0e0e3ab03c1e82097536cdf52d57b63a6
MD5 d6943973b1901817751cc603f1d1c156
SHA1 e473ecac5a807ac3fe042c8981ca20f73406da27
SHA512 b2fb938c8dd487a5adf57aff55ff533cf68c429d5f1a87f45756ed07cd812a45da169483a516cea6722903013568ce293fad6ff0a5d4db1794dd4e6daa0c0f89
SSDEEP 98304:WIrEcrCFKGe03pEAzO7yn6VkfC6x+S35rrvfv1vCvT3v+vpvav3vr6+uymCywG2O:WjiCFR93uy/n525k
TLSH
T14CD65A47ECA511E5C0AED175CA2695237B713C895B3463D72B90F6282F33BD0AEB9B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-04_d6943973b1901817751cc603f1d1c156_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-06-04_d6943973b1901817751cc603f1d1c156_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 12.4MB

2026-06-04_d6943973b1901817751cc603f1d1c156_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 9cd4ad010e1d3ff5c00eb1edf0995af0e0e3ab03c1e82097536cdf52d57b63a6
MD5 d6943973b1901817751cc603f1d1c156
SHA1 e473ecac5a807ac3fe042c8981ca20f73406da27
SHA512 b2fb938c8dd487a5adf57aff55ff533cf68c429d5f1a87f45756ed07cd812a45da169483a516cea6722903013568ce293fad6ff0a5d4db1794dd4e6daa0c0f89
SSDEEP 98304:WIrEcrCFKGe03pEAzO7yn6VkfC6x+S35rrvfv1vCvT3v+vpvav3vr6+uymCywG2O:WjiCFR93uy/n525k
TLSH
T14CD65A47ECA511E5C0AED175CA2695237B713C895B3463D72B90F6282F33BD0AEB9B10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

560864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

602KB

Virtual Size

32.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

140KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

2026-06-04_d6943973b1901817751cc603f1d1c156_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic