2026-07-30_9d30ac841c3eb6a7901dfd93be93f931_coinminer_dosia_eternalromance_glassworm_poet-rat_quasar-rat_rex_snatch

General

Target
2026-07-30_9d30ac841c3eb6a7901dfd93be93f931_coinminer_dosia_eternalromance_glassworm_poet-rat_quasar-rat_rex_snatch
Size 31.8MB
Sample260730-18c2yaybld
SHA256 6e88fcc88133de3108f97728dd7a4ef9086e0cfcef6a9593bb6a9e537ee09aab
MD5 9d30ac841c3eb6a7901dfd93be93f931
SHA1 e9baa32a69bf056e8c0663479541fa0c73c5fe81
SHA512 8487e2d6d218da2a69b9601b1c124a27358d961301c2944029be3aacdadb3f68b2c7d921e997761aff03a06b7b1cbdfa7755f4f5505974e78ff32720c097b40c
SSDEEP 98304:FdzNAjgZsRgOvZvUtkmY4isrRIkXx9Jf1RPV+M1sKVtTXfh2TSypO3G96E:XysZsRhvUaEDJ1RPV+M1sKnrfqnO29n
TLSH
T1F4771713FDA5A594C0988231C362D5D77AA3B886472413C73ADCBF6E2F72BC054BA365
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Fscan network and vulnerability scanner 1 IoCs

Fscan can be abused to discover, brute-force, and exploit services to gain unauthorized access. It is an open-source network scanner used for asset discovery and vulnerability identification.

hacktool discovery exploit

resource	yara_rule
sample	tool_fscan

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_9d30ac841c3eb6a7901dfd93be93f931_coinminer_dosia_eternalromance_glassworm_poet-rat_quasar-rat_rex_snatch

File Explorer

2026-07-30_9d30ac841c3eb6a7901dfd93be93f931_coinminer_dosia_eternalromance_glassworm_poet-rat_quasar-rat_rex_snatch

.exe 31.8MB