2026-07-24_c8788308a499d4979c0e603df6f3ce28_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-24_c8788308a499d4979c0e603df6f3ce28_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 6.0MB
Sample260724-l4cs2sxdqa
SHA256 bc26864307647c8467bbc13a50a1f291dcc06d040cdda656688f6b45c08f4e65
MD5 c8788308a499d4979c0e603df6f3ce28
SHA1 73161bb955ec46acc37c7696a795975340a5b90d
SHA512 e875f16df8cf98dc403583675f5b6dc74fa4d2723ba35e5a97c390343a074dabf98690b495539583f2388b4695263b9a8c3973501db74a323e368837b45dedd2
SSDEEP 49152:y7/la70f0pQtZMsEjzqRx8KI/cHgWi+WLqhpWlIRh0t3Y2FEGKQK1K6TUQgZhJ5k:y798JfuR3Claw8gZhEX
TLSH
T1D7564A43FCA518E9C0AED13489769213BB617C481B2123D72B90F6396FB7BE0AD79354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-24_c8788308a499d4979c0e603df6f3ce28_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-07-24_c8788308a499d4979c0e603df6f3ce28_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 6.0MB

2026-07-24_c8788308a499d4979c0e603df6f3ce28_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 bc26864307647c8467bbc13a50a1f291dcc06d040cdda656688f6b45c08f4e65
MD5 c8788308a499d4979c0e603df6f3ce28
SHA1 73161bb955ec46acc37c7696a795975340a5b90d
SHA512 e875f16df8cf98dc403583675f5b6dc74fa4d2723ba35e5a97c390343a074dabf98690b495539583f2388b4695263b9a8c3973501db74a323e368837b45dedd2
SSDEEP 49152:y7/la70f0pQtZMsEjzqRx8KI/cHgWi+WLqhpWlIRh0t3Y2FEGKQK1K6TUQgZhJ5k:y798JfuR3Claw8gZhEX
TLSH
T1D7564A43FCA518E9C0AED13489769213BB617C481B2123D72B90F6396FB7BE0AD79354
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

547680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

311KB

Virtual Size

32.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-07-24_c8788308a499d4979c0e603df6f3ce28_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic