General
- Target 2026-07-27_e1186c694167c08bf52c18050796e6c4_akira_coinminer_dosia_glassworm_luca-stealer_poet-rat_quasar-rat_rusty-stealer
- Size 111.2MB
- Sample260727-1j8gjsdd62
- SHA256 64fa024e0563eb6fa06cb6437c76a652021a93dff78979496b4b005e61639e78
- MD5 e1186c694167c08bf52c18050796e6c4
- SHA1 199a2d00708e3527921f6dcf5af8df00ebc4e089
- SHA512 81a1b3df0b5d4773d1e9cbc3f60efc435bf8d3f854cd2d1c27ae5c6632ae4f581601e477c0a2f0d584a866a7f3f7164213a562338ba4d2609ee98e618ade52c2
- SSDEEP 196608:eicuWj6SbuhXRmyiQvKiYYHMupfMYALYCd:eiNW+kudRmyiGvHMu9hpC
- TLSH T10948445495B447E98768267553327C5913EAD9E9C883249FC3A06BD52BFBF02E30E8F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-27_e1186c694167c08bf52c18050796e6c4_akira_coinminer_dosia_glassworm_luca-stealer_poet-rat_quasar-rat_rusty-stealer.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_e1186c694167c08bf52c18050796e6c4_akira_coinminer_dosia_glassworm_luca-stealer_poet-rat_quasar-rat_rusty-stealer.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-27_e1186c694167c08bf52c18050796e6c4_akira_coinminer_dosia_glassworm_luca-stealer_poet-rat_quasar-rat_rusty-stealer
- Size 111.2MB
- SHA256 64fa024e0563eb6fa06cb6437c76a652021a93dff78979496b4b005e61639e78
- MD5 e1186c694167c08bf52c18050796e6c4
- SHA1 199a2d00708e3527921f6dcf5af8df00ebc4e089
- SHA512 81a1b3df0b5d4773d1e9cbc3f60efc435bf8d3f854cd2d1c27ae5c6632ae4f581601e477c0a2f0d584a866a7f3f7164213a562338ba4d2609ee98e618ade52c2
- SSDEEP 196608:eicuWj6SbuhXRmyiQvKiYYHMupfMYALYCd:eiNW+kudRmyiGvHMu9hpC
- TLSH T10948445495B447E98768267553327C5913EAD9E9C883249FC3A06BD52BFBF02E30E8F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Enumerates VirtualBox DLL files
-
Looks for VirtualBox drivers on disk
-
Looks for VirtualBox executables on disk
-
Looks for VMWare drivers on disk
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2