2026-07-20_83b74e77fe4afdb7157eefeecb098b55_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_83b74e77fe4afdb7157eefeecb098b55_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 5.8MB
Sample260720-ded1tafz2s
SHA256 87c128af14f2c8cc4508f3bb1ef2afe028173465855cd1f9d7add3e50b2379d2
MD5 83b74e77fe4afdb7157eefeecb098b55
SHA1 17f13daf833ce00e9a668a2e3f02ed6eb5cbf9bf
SHA512 c60801ad89db9695c8f4f3c73839946cf31675ef7b8bf88392dfe27af3299f0995a544a6f4040574831334ea02d522bff10ead96fc7048f7d96b80f34bf34cd1
SSDEEP 49152:gBwB8l9FfUCGl5rnSvxJFohhsppiLOlQufzhSixUE8oyYrGKQK1K6lP7z5Eg:gBZPOxzLVCdXlPBE
TLSH
T160565B03FCA914E9C1AED1748A629552BB717C495B2123D72B90F6383F73BD0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_83b74e77fe4afdb7157eefeecb098b55_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-07-20_83b74e77fe4afdb7157eefeecb098b55_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 5.8MB

2026-07-20_83b74e77fe4afdb7157eefeecb098b55_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 87c128af14f2c8cc4508f3bb1ef2afe028173465855cd1f9d7add3e50b2379d2
MD5 83b74e77fe4afdb7157eefeecb098b55
SHA1 17f13daf833ce00e9a668a2e3f02ed6eb5cbf9bf
SHA512 c60801ad89db9695c8f4f3c73839946cf31675ef7b8bf88392dfe27af3299f0995a544a6f4040574831334ea02d522bff10ead96fc7048f7d96b80f34bf34cd1
SSDEEP 49152:gBwB8l9FfUCGl5rnSvxJFohhsppiLOlQufzhSixUE8oyYrGKQK1K6lP7z5Eg:gBZPOxzLVCdXlPBE
TLSH
T160565B03FCA914E9C1AED1748A629552BB717C495B2123D72B90F6383F73BD0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

548704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

304KB

Virtual Size

32.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-07-20_83b74e77fe4afdb7157eefeecb098b55_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic