1a4198ec28c6e4fdda790af620254a85182222145035c8e67fd2eaab09970be5 | Triage™

Login
Reports

Overview

overview

7

Static

static

3

2026-07-30...ch.exe

windows10-2004-x64

7

2026-07-30...ch.exe

windows11-ltsc_2024-x64

7

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 15:23

Sharing

Copy URL Twitter E-mail

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2026-07-30_76c76e33561109c19778f77faf29c81c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

credential_access discovery spyware stealer

Behavioral task

behavioral2

Sample

2026-07-30_76c76e33561109c19778f77faf29c81c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

credential_access discovery spyware stealer

Report Analysis Logs

General

Target
2026-07-30_76c76e33561109c19778f77faf29c81c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 6.7MB
Sample260730-ssvcaa1bmb
SHA256 1a4198ec28c6e4fdda790af620254a85182222145035c8e67fd2eaab09970be5
MD5 76c76e33561109c19778f77faf29c81c
SHA1 f6fa7363ca6d11626e6717a4f4189985887fb7be
SHA512 82eb499dcce6b57dc32ba1b3816e865cc25ddfc003c47e6a7b442dae76979a49f382dbb5b4c004952d7f6e3bb60fea32b8ac7c5429f4e50ca8e57f1d6db218e6
SSDEEP 49152:evjM1b9Ni6velfRbnlFuaydeXxZR2uHYy0B26bWqFevKONZPZs3E4VPOLuLHLLL5:evIlbgfXP+36slONZPZsLL8eqE
TLSH
T147664A07ECA925E9C0AEA17185739653BB317C490B3123D72B90F6243F72BE0AE79754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Processes

C:\Users\Admin\AppData\Local\Temp\2026-07-30_76c76e33561109c19778f77faf29c81c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_76c76e33561109c19778f77faf29c81c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2026

Terms | Privacy