General
- Target 2026-06-30_afafb148def48e9cad87259626957b95_coinminer_dosia_glassworm_helldown_luca-stealer_poet-rat_quasar-rat
- Size 22.4MB
- Sample260701-dvlqlafs8v
- SHA256 35393a3b32c476519799c62336a391fa84d30f6db3c129cfc324d9eec0845d71
- MD5 afafb148def48e9cad87259626957b95
- SHA1 f366fcd78bf72c259b52a52f4e665ebb7408b1fa
- SHA512 2dfd38a809a17038731ca40e574d2fb7bc5d3c812e68951eb2a2ba164604f27add56cda895cc10c83b2420025d1b01db69272b706429e724f56f701475777dd3
- SSDEEP 196608:QP2GqneV5jjNUOrenrvF3FAI794DNXa61M:QOBeV1KOrOjdz945XaZ
- TLSH T11C374B17E8A000D8E8A9D134C672A623BAB17C8D5B3533D72B90F7643F72BD066B9754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-06-30_afafb148def48e9cad87259626957b95_coinminer_dosia_glassworm_helldown_luca-stealer_poet-rat_quasar-rat.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_afafb148def48e9cad87259626957b95_coinminer_dosia_glassworm_helldown_luca-stealer_poet-rat_quasar-rat.exe
Resource
win11ltsc2024-20260630-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-30_afafb148def48e9cad87259626957b95_coinminer_dosia_glassworm_helldown_luca-stealer_poet-rat_quasar-rat
- Size 22.4MB
- SHA256 35393a3b32c476519799c62336a391fa84d30f6db3c129cfc324d9eec0845d71
- MD5 afafb148def48e9cad87259626957b95
- SHA1 f366fcd78bf72c259b52a52f4e665ebb7408b1fa
- SHA512 2dfd38a809a17038731ca40e574d2fb7bc5d3c812e68951eb2a2ba164604f27add56cda895cc10c83b2420025d1b01db69272b706429e724f56f701475777dd3
- SSDEEP 196608:QP2GqneV5jjNUOrenrvF3FAI794DNXa61M:QOBeV1KOrOjdz945XaZ
- TLSH T11C374B17E8A000D8E8A9D134C672A623BAB17C8D5B3533D72B90F7643F72BD066B9754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables Discord URL observed in first stage droppers
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)