478eeab0ff927be4821ebc3dc5d16a1eaa1d7c72e08bca22abccc35657218fa8

General

Target
2026-07-17_097964b84dc9fa420b11835103e92b5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 29.0MB
Sample260718-flgrdsgz5l
SHA256 478eeab0ff927be4821ebc3dc5d16a1eaa1d7c72e08bca22abccc35657218fa8
MD5 097964b84dc9fa420b11835103e92b5e
SHA1 71d71da6c0e0547981d4268650ba033137913c92
SHA512 19b85e28ed87c07213d6eff2b6cd79ca97287107b6af921d779c08978bc0ad53eb1d8c8f6c7e54665930b8085cc43f9558e40e2653e19eba86dca3a65ef13ae5
SSDEEP 196608:El3qyAbBbDI80o9yr+6fizWC7WWrRA0OXVJYMx4/tajK3Xw7Ytp8/Xxhl0jSX:ElZ4np6fiK3ADMKFaeHw7YtK5nvX
TLSH
T171676C67F89216D8C4EEC574E672812BBB613C190B7863E716A0F3205F37BD09AB6711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-17_097964b84dc9fa420b11835103e92b5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 29.0MB
- SHA256 478eeab0ff927be4821ebc3dc5d16a1eaa1d7c72e08bca22abccc35657218fa8
- MD5 097964b84dc9fa420b11835103e92b5e
- SHA1 71d71da6c0e0547981d4268650ba033137913c92
- SHA512 19b85e28ed87c07213d6eff2b6cd79ca97287107b6af921d779c08978bc0ad53eb1d8c8f6c7e54665930b8085cc43f9558e40e2653e19eba86dca3a65ef13ae5
- SSDEEP 196608:El3qyAbBbDI80o9yr+6fizWC7WWrRA0OXVJYMx4/tajK3Xw7Ytp8/Xxhl0jSX:ElZ4np6fiK3ADMKFaeHw7YtK5nvX
- TLSH
  T171676C67F89216D8C4EEC574E672812BBB613C190B7863E716A0F3205F37BD09AB6711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence spyware stealer trojan
- Detects executables containing URLs to raw contents of a Github gist
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2