2026-07-10_0a1a26d768e3581b83c337f7d3000ed0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_0a1a26d768e3581b83c337f7d3000ed0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 42.7MB
Sample260710-e7z97ac15p
SHA256 8329a0b7695de6ca46c88b727d97a0c5994f471303bc644563420f4119ae05fe
MD5 0a1a26d768e3581b83c337f7d3000ed0
SHA1 4a3875296271181fbdd00aa6384459bb8eb8532b
SHA512 ee4f2a0dc450abc19c8f9dc6ceee810045c58dcb50bf2a5903b812e43c5322714e4724ba7be60c1227720f229d7763c13adeb0e8bf2944fb9f60a87d9fe679d0
SSDEEP 196608:5zJusVIGgM8LTgsHpUJt1IlxxNYStgjGxAyDRteH+0Ts1tzPUt+dmdrgy:5gsVIGGssHug1i0tee4sUt+dzy
TLSH
T158A72B53F8D21A84D5AAC574C772817BB762382D077823E71690F3201F3ABE0EAB6755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_0a1a26d768e3581b83c337f7d3000ed0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-07-10_0a1a26d768e3581b83c337f7d3000ed0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 42.7MB

2026-07-10_0a1a26d768e3581b83c337f7d3000ed0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 8329a0b7695de6ca46c88b727d97a0c5994f471303bc644563420f4119ae05fe
MD5 0a1a26d768e3581b83c337f7d3000ed0
SHA1 4a3875296271181fbdd00aa6384459bb8eb8532b
SHA512 ee4f2a0dc450abc19c8f9dc6ceee810045c58dcb50bf2a5903b812e43c5322714e4724ba7be60c1227720f229d7763c13adeb0e8bf2944fb9f60a87d9fe679d0
SSDEEP 196608:5zJusVIGgM8LTgsHpUJt1IlxxNYStgjGxAyDRteH+0Ts1tzPUt+dmdrgy:5gsVIGGssHug1i0tee4sUt+dzy
TLSH
T158A72B53F8D21A84D5AAC574C772817BB762382D077823E71690F3201F3ABE0EAB6755
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables (downlaoders) containing URLs to raw contents of a paste
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

523296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

27.2MB

Virtual Size

27.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13.9MB

Virtual Size

13.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

768KB

Virtual Size

33.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

427KB

Virtual Size

426KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

357KB

Virtual Size

356KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-07-10_0a1a26d768e3581b83c337f7d3000ed0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic