2026-07-30_531e75db53a7088f6a8ac01a5c21fb6b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_531e75db53a7088f6a8ac01a5c21fb6b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 10.5MB
Sample260730-2f384a1ydt
SHA256 364babe2907ba9e688ec832fdf0206244be7bba117afc8bdd33f6885c52167c9
MD5 531e75db53a7088f6a8ac01a5c21fb6b
SHA1 3d8edf60f8b86c0cca75f8e1f84623a073693586
SHA512 61b515b8df35fe75a8bbbff0088d194ff2b82b87c2f21630064a6f983abef34b73e14074d3d4c591752386474aab0e0e5808123a35992f6c9b69839819b74e5a
SSDEEP 98304:vYmny1fT7pOB0XrRJU+RrDV4zTsGDyb9WE:vBy9NOcbrDinOT
TLSH
T194B64947EDA505E5C0AED176C6369A17BA713C884B2063D72B60F7242F77BD0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_531e75db53a7088f6a8ac01a5c21fb6b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-07-30_531e75db53a7088f6a8ac01a5c21fb6b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 10.5MB

2026-07-30_531e75db53a7088f6a8ac01a5c21fb6b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 364babe2907ba9e688ec832fdf0206244be7bba117afc8bdd33f6885c52167c9
MD5 531e75db53a7088f6a8ac01a5c21fb6b
SHA1 3d8edf60f8b86c0cca75f8e1f84623a073693586
SHA512 61b515b8df35fe75a8bbbff0088d194ff2b82b87c2f21630064a6f983abef34b73e14074d3d4c591752386474aab0e0e5808123a35992f6c9b69839819b74e5a
SSDEEP 98304:vYmny1fT7pOB0XrRJU+RrDV4zTsGDyb9WE:vBy9NOcbrDinOT
TLSH
T194B64947EDA505E5C0AED176C6369A17BA713C884B2063D72B60F7242F77BD0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

557504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

489KB

Virtual Size

32.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-07-30_531e75db53a7088f6a8ac01a5c21fb6b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic