General
- Target 2026-07-21_e63153d8730c4573c6ea636863953208_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 8.8MB
- Sample260721-be6dysaz5m
- SHA256 e1334733c199005e5d78da7b22e364ea625856a204dc5978116118964b431ef8
- MD5 e63153d8730c4573c6ea636863953208
- SHA1 1a3d74ee15632743c762f0cc056fd06a33a97fd2
- SHA512 6e78c12f9b5713341421b768e8d705d0c9cecd127eab15f699ef37e96d05f205e8962b143605fb0e6576e5bbd9125e95313ec545e9a68f017c3a9e2d0e4f80ed
- SSDEEP 98304:aOV9Gx3qTlb3SO+QMXEFWU1wlU5YuIHFbdGYYvoCmr7CFZF5lT8avmX1oHxZO:aCs+sQ1hoUaHFbavoiPvmFoH6
- TLSH T1AA969C07FC9924E9C1AED13589729653BB617C482B2123D76B90F3382F72BD1ADB9350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-21_e63153d8730c4573c6ea636863953208_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-21_e63153d8730c4573c6ea636863953208_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-21_e63153d8730c4573c6ea636863953208_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 8.8MB
- SHA256 e1334733c199005e5d78da7b22e364ea625856a204dc5978116118964b431ef8
- MD5 e63153d8730c4573c6ea636863953208
- SHA1 1a3d74ee15632743c762f0cc056fd06a33a97fd2
- SHA512 6e78c12f9b5713341421b768e8d705d0c9cecd127eab15f699ef37e96d05f205e8962b143605fb0e6576e5bbd9125e95313ec545e9a68f017c3a9e2d0e4f80ed
- SSDEEP 98304:aOV9Gx3qTlb3SO+QMXEFWU1wlU5YuIHFbdGYYvoCmr7CFZF5lT8avmX1oHxZO:aCs+sQ1hoUaHFbavoiPvmFoH6
- TLSH T1AA969C07FC9924E9C1AED13589729653BB617C482B2123D76B90F3382F72BD1ADB9350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.