General
- Target 2026-07-19_e56caa50c24da94830e496b55154003e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.5MB
- Sample260719-b44awsg12j
- SHA256 c8f8b72419518a27f6c921075878828105b87e19d824c87e904e36c6fd495829
- MD5 e56caa50c24da94830e496b55154003e
- SHA1 15c61d66ed50879699e5165fa28eb2e9dda45b5f
- SHA512 0e77fc1ae73445f62069e283d3aac91717bec0fd5729a16ccfa59fd3c44c3c01c5309665d1ea6aaf60e6e9b5c4bca5411317ce2ea65528f9d8031d12f25455bb
- SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8K:T6BJUoROZfIA8Xf8xumvBh8huTEEmX
- TLSH T13C665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_e56caa50c24da94830e496b55154003e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_e56caa50c24da94830e496b55154003e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-19_e56caa50c24da94830e496b55154003e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.5MB
- SHA256 c8f8b72419518a27f6c921075878828105b87e19d824c87e904e36c6fd495829
- MD5 e56caa50c24da94830e496b55154003e
- SHA1 15c61d66ed50879699e5165fa28eb2e9dda45b5f
- SHA512 0e77fc1ae73445f62069e283d3aac91717bec0fd5729a16ccfa59fd3c44c3c01c5309665d1ea6aaf60e6e9b5c4bca5411317ce2ea65528f9d8031d12f25455bb
- SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8K:T6BJUoROZfIA8Xf8xumvBh8huTEEmX
- TLSH T13C665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application