2026-06-28_ef4c778cc00449d703a946dd2889e523_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-28_ef4c778cc00449d703a946dd2889e523_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 5.9MB
Sample260628-wpc6dabt3n
SHA256 2f7e04dd499107fcbcd124d859bbe3d4479b1e7acf2b1c05daff57c9a8a4b0f0
MD5 ef4c778cc00449d703a946dd2889e523
SHA1 cb06b480a3a550dfbc64924d661ab6a2ad737a11
SHA512 e2c36f388662da00a4e62588ad3d48761c559ae28971af253df9f41fbdf8e64ffefe066f14a7be953ce7f78a056678021720ad0d6d04f9dfe9c7dc4499957970
SSDEEP 49152:8TX+YbY0dJmHi9/ebr7pUgwbluI81XSc8yYhMG1SLze2UKQK1K6GyGqu5Ex:8TNMMw9pcutMKf9VXkE
TLSH
T1DE563903FD5515E5C0AED1308A7A9253BB717C891B2123D32B60B6387FB6BE0ADB9714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_ef4c778cc00449d703a946dd2889e523_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-06-28_ef4c778cc00449d703a946dd2889e523_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 5.9MB

2026-06-28_ef4c778cc00449d703a946dd2889e523_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 2f7e04dd499107fcbcd124d859bbe3d4479b1e7acf2b1c05daff57c9a8a4b0f0
MD5 ef4c778cc00449d703a946dd2889e523
SHA1 cb06b480a3a550dfbc64924d661ab6a2ad737a11
SHA512 e2c36f388662da00a4e62588ad3d48761c559ae28971af253df9f41fbdf8e64ffefe066f14a7be953ce7f78a056678021720ad0d6d04f9dfe9c7dc4499957970
SSDEEP 49152:8TX+YbY0dJmHi9/ebr7pUgwbluI81XSc8yYhMG1SLze2UKQK1K6GyGqu5Ex:8TNMMw9pcutMKf9VXkE
TLSH
T1DE563903FD5515E5C0AED1308A7A9253BB717C891B2123D32B60B6387FB6BE0ADB9714
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

554400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

304KB

Virtual Size

32.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-06-28_ef4c778cc00449d703a946dd2889e523_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic