General
- Target 2026-07-10_34b9dc3ed21f147493c5227f3f3f3ae3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.5MB
- Sample260710-a3d4yacw9s
- SHA256 10e21b37c2ed2c17cb1c430eb1b7045c5d7a7d52a83444025de0592a4a2218ca
- MD5 34b9dc3ed21f147493c5227f3f3f3ae3
- SHA1 ff7fe82abe6da7aa69b23f2b52c1e028c1e1f0ce
- SHA512 a694b6af59b884067802a4e07c01cdcb1cbf2939efe333826d8ffbb75c2e27fe32f3f779616f49f5ed419abfc0e6b3ade7f5481c6d6670b261680a60ba41d674
- SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8p:T6BJUoROZfIA8Xf8xumvBh8huTEEmA
- TLSH T1F4665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_34b9dc3ed21f147493c5227f3f3f3ae3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_34b9dc3ed21f147493c5227f3f3f3ae3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-10_34b9dc3ed21f147493c5227f3f3f3ae3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.5MB
- SHA256 10e21b37c2ed2c17cb1c430eb1b7045c5d7a7d52a83444025de0592a4a2218ca
- MD5 34b9dc3ed21f147493c5227f3f3f3ae3
- SHA1 ff7fe82abe6da7aa69b23f2b52c1e028c1e1f0ce
- SHA512 a694b6af59b884067802a4e07c01cdcb1cbf2939efe333826d8ffbb75c2e27fe32f3f779616f49f5ed419abfc0e6b3ade7f5481c6d6670b261680a60ba41d674
- SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8p:T6BJUoROZfIA8Xf8xumvBh8huTEEmA
- TLSH T1F4665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application