4788b3f8a76b1de668c2a602a12c82f2396b3e1d13e2d5c6ea2c8711da8b77af

General

Target
2026-06-27_d8a7a3f821bcc49384eec66773c4355d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 12.9MB
Sample260629-ct2vrabs4y
SHA256 4788b3f8a76b1de668c2a602a12c82f2396b3e1d13e2d5c6ea2c8711da8b77af
MD5 d8a7a3f821bcc49384eec66773c4355d
SHA1 ed754a77002f3e03287a1415517e43e34a5cb5c6
SHA512 4bcc9ef66ac2644af7901ed9db777d357d13a4d9db50a4b3c0df161e1d8115439b1071a45d627bbf863e8b7bead46358dc666fd018876650e5e7076dc3f1d012
SSDEEP 98304:OboAnmsfOuEevvk6tXXFpIV8qvPGMUdJObE/:OVm1VFOhJOI/
TLSH
T1E6D64847ECA505E8C0ADD13686229A52BB713C894B3177D75F90FA242F37BE0ADB9710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-06-27_d8a7a3f821bcc49384eec66773c4355d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 12.9MB
- SHA256 4788b3f8a76b1de668c2a602a12c82f2396b3e1d13e2d5c6ea2c8711da8b77af
- MD5 d8a7a3f821bcc49384eec66773c4355d
- SHA1 ed754a77002f3e03287a1415517e43e34a5cb5c6
- SHA512 4bcc9ef66ac2644af7901ed9db777d357d13a4d9db50a4b3c0df161e1d8115439b1071a45d627bbf863e8b7bead46358dc666fd018876650e5e7076dc3f1d012
- SSDEEP 98304:OboAnmsfOuEevvk6tXXFpIV8qvPGMUdJObE/:OVm1VFOhJOI/
- TLSH
  T1E6D64847ECA505E8C0ADD13686229A52BB713C894B3177D75F90FA242F37BE0ADB9710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution ransomware spyware stealer adware persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2