2026-07-06_689013600dfdc129a3234a2a1162a314_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch

General

Target
2026-07-06_689013600dfdc129a3234a2a1162a314_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch
Size 13.1MB
Sample260707-dstnesgy2x
SHA256 b7418aeca711d516449a99493515b3d12139eabb9681f87a9ef530e6afef8a0e
MD5 689013600dfdc129a3234a2a1162a314
SHA1 20eac52a88762dc200d5368b88af23308b16c065
SHA512 f0bf95e928a926463897a2bf98618d1fc2d318f94a8f2ed21ed915019f20c2f3e528e0189b809e4ed6068b2b93c324647cc47e0117a418cbfdfde92f20e4a796
SSDEEP 98304:6kO9XFQSDM4thx0a1aHYc39ZnwZnQiTdrivfvwvvvcCv+vpvOv3vtWeYo2glI/US:6YQM2LT6aReOAJz
TLSH
T17BD64A87EDA516E5C0EE8135C66696537B713C884B3063D3AF50BA242F33BD4AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_689013600dfdc129a3234a2a1162a314_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch

2026-07-06_689013600dfdc129a3234a2a1162a314_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch

.exe 13.1MB

SHA256 b7418aeca711d516449a99493515b3d12139eabb9681f87a9ef530e6afef8a0e
MD5 689013600dfdc129a3234a2a1162a314
SHA1 20eac52a88762dc200d5368b88af23308b16c065
SHA512 f0bf95e928a926463897a2bf98618d1fc2d318f94a8f2ed21ed915019f20c2f3e528e0189b809e4ed6068b2b93c324647cc47e0117a418cbfdfde92f20e4a796
SSDEEP 98304:6kO9XFQSDM4thx0a1aHYc39ZnwZnQiTdrivfvwvvvcCv+vpvOv3vtWeYo2glI/US:6YQM2LT6aReOAJz
TLSH
T17BD64A87EDA516E5C0EE8135C66696537B713C884B3063D3AF50BA242F33BD4AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

556672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths