5698b981bd243a6acca94d2db9db10841b02783f694d91e1ceed4e85c7210216

General

Target
2026-07-07_a33d035f6a5790ee3bc6ab15f6456254_coinminer_dosia_poet-rat_quasar-rat_snatch
Size 26.5MB
Sample260707-2txngags7n
SHA256 5698b981bd243a6acca94d2db9db10841b02783f694d91e1ceed4e85c7210216
MD5 a33d035f6a5790ee3bc6ab15f6456254
SHA1 50d8bd29d8128a33c3c30422089a6ffb603607e3
SHA512 1653fbaf4f1700fa2503e1a978a1c7f45620d05a70b3e5482821d92fd9624859ad588fc36340ec09cdbe8443434c770dda74144854b10d05b9927453de50345b
SSDEEP 196608:3CtDnfVFAKfcdutrPpA1fgybY/bX5IGPajknVxJq3KXZAUF65WmMjx:3PKrtNxPX5IGSExJq3KBFN
TLSH
T1BA573A63F8921994C4EAC074D776413BBA613C691B7823E72694F3205F3BBD09BB6B41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-07_a33d035f6a5790ee3bc6ab15f6456254_coinminer_dosia_poet-rat_quasar-rat_snatch
- Size 26.5MB
- SHA256 5698b981bd243a6acca94d2db9db10841b02783f694d91e1ceed4e85c7210216
- MD5 a33d035f6a5790ee3bc6ab15f6456254
- SHA1 50d8bd29d8128a33c3c30422089a6ffb603607e3
- SHA512 1653fbaf4f1700fa2503e1a978a1c7f45620d05a70b3e5482821d92fd9624859ad588fc36340ec09cdbe8443434c770dda74144854b10d05b9927453de50345b
- SSDEEP 196608:3CtDnfVFAKfcdutrPpA1fgybY/bX5IGPajknVxJq3KXZAUF65WmMjx:3PKrtNxPX5IGSExJq3KBFN
- TLSH
  T1BA573A63F8921994C4EAC074D776413BBA613C691B7823E72694F3205F3BBD09BB6B41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion adware persistence ransomware spyware
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1 behavioral2