f232e6049ddf1a6a7c9343be9c10b3a0792fca69b8a9543ea30d9d5a2194ffc0

General

Target
2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
Size 12.3MB
Sample260722-gm124abb78
SHA256 f232e6049ddf1a6a7c9343be9c10b3a0792fca69b8a9543ea30d9d5a2194ffc0
MD5 20bf542347e62a95c0ef7adf81edab42
SHA1 d53a2773ff77db1167747289f93689b002cb918e
SHA512 638917e7aea8666d2efc360e57586d301cd173e7b384ace760d385b142f1b970634fcb7573b9ce57527118dd1f49e845aefa2cca3c3950da9e40e16568fb5e6a
SSDEEP 98304:CXwlhJ9FISTkFivrhgLE9z6u1uZkrnvVv+vpvz8HcAPsNV3cwWEets:CU/BQZ5x93ccws
TLSH
T1D1D63947E8A546E4D0AED135C66692237F713C884B3063D72BA0F6252F77BD0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-22_20bf542347e62a95c0ef7adf81edab42_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
- Size 12.3MB
- SHA256 f232e6049ddf1a6a7c9343be9c10b3a0792fca69b8a9543ea30d9d5a2194ffc0
- MD5 20bf542347e62a95c0ef7adf81edab42
- SHA1 d53a2773ff77db1167747289f93689b002cb918e
- SHA512 638917e7aea8666d2efc360e57586d301cd173e7b384ace760d385b142f1b970634fcb7573b9ce57527118dd1f49e845aefa2cca3c3950da9e40e16568fb5e6a
- SSDEEP 98304:CXwlhJ9FISTkFivrhgLE9z6u1uZkrnvVv+vpvz8HcAPsNV3cwWEets:CU/BQZ5x93ccws
- TLSH
  T1D1D63947E8A546E4D0AED135C66692237F713C884B3063D72BA0F6252F77BD0AEB9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery persistence privilege_escalation spyware stealer trojan
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables containing possible sandbox system UUIDs
- Detects executables referencing virtualization MAC addresses
- Detects executables using Telegram Chat Bot
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2