2026-07-03_06c255e08f06ca379358b18743166a0f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_06c255e08f06ca379358b18743166a0f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 6.4MB
Sample260703-kv2kdaes8x
SHA256 2fb51b5214f868213c7eeee2afe9d47fc696d889251f024cd3b3be04ede02431
MD5 06c255e08f06ca379358b18743166a0f
SHA1 55f0badffb5510c3802e624a6dc5f42e8dd4b287
SHA512 9da9efa74a0666bd22074c2cdad2d8e0dba7d59529e2ee07a45beee9023de3dc49256e6a6c7ede96c58e0dbc6cefb2bc5b6625d04ec3bc8f80ed7d43e6a28653
SSDEEP 49152:qTpXmjFtcrY4ensSLKMiRwrLwbYtPKT4u622uzuXoSZVUTFRzKfK1Ks/2//D/5E:qTh0fXLD22yRd/4tE
TLSH
T1BF664A13EC6555E4C1AED2318A72A613BB717C895B3123C71B60F6242F77BE0ADB9318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_06c255e08f06ca379358b18743166a0f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-07-03_06c255e08f06ca379358b18743166a0f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 6.4MB

2026-07-03_06c255e08f06ca379358b18743166a0f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 2fb51b5214f868213c7eeee2afe9d47fc696d889251f024cd3b3be04ede02431
MD5 06c255e08f06ca379358b18743166a0f
SHA1 55f0badffb5510c3802e624a6dc5f42e8dd4b287
SHA512 9da9efa74a0666bd22074c2cdad2d8e0dba7d59529e2ee07a45beee9023de3dc49256e6a6c7ede96c58e0dbc6cefb2bc5b6625d04ec3bc8f80ed7d43e6a28653
SSDEEP 49152:qTpXmjFtcrY4ensSLKMiRwrLwbYtPKT4u622uzuXoSZVUTFRzKfK1Ks/2//D/5E:qTh0fXLD22yRd/4tE
TLSH
T1BF664A13EC6555E4C1AED2318A72A613BB717C895B3123C71B60F6242F77BE0ADB9318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

551360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

335KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-07-03_06c255e08f06ca379358b18743166a0f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic