2026-08-01_a8e8615c9f93d607efda28caed86d45a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_a8e8615c9f93d607efda28caed86d45a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 6.7MB
Sample260801-dbkn7awdld
SHA256 a7a49cf158188b4d09fc55b9c352bce29a03594d583c2e8eb419ea82d908d407
MD5 a8e8615c9f93d607efda28caed86d45a
SHA1 c4ddd3801b7d5c4ad256b6e644291310f1fdd07e
SHA512 05d6d0f1cbf2eec6877ce250ea8f74b0174b36fb4aa4cf249754c0473c42ed5096fd6dbcf338ada0478054e2239177ad5cef8a91f544e386d3ccf3b868bc7b4b
SSDEEP 49152:sg+1BLxnKFfGgvEyvP2a98DuQ+bQs99WsiPK1KVNMAXjWXcuMXvQCVfNG2q6VKQg:sg8BVKTvPfEOadHqXaFtzE
TLSH
T10E664A07FCA419E9C1ADD1348A779553BB617C890B2123D32B90F6283FB6BE06D79364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_a8e8615c9f93d607efda28caed86d45a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-08-01_a8e8615c9f93d607efda28caed86d45a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 6.7MB

2026-08-01_a8e8615c9f93d607efda28caed86d45a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 a7a49cf158188b4d09fc55b9c352bce29a03594d583c2e8eb419ea82d908d407
MD5 a8e8615c9f93d607efda28caed86d45a
SHA1 c4ddd3801b7d5c4ad256b6e644291310f1fdd07e
SHA512 05d6d0f1cbf2eec6877ce250ea8f74b0174b36fb4aa4cf249754c0473c42ed5096fd6dbcf338ada0478054e2239177ad5cef8a91f544e386d3ccf3b868bc7b4b
SSDEEP 49152:sg+1BLxnKFfGgvEyvP2a98DuQ+bQs99WsiPK1KVNMAXjWXcuMXvQCVfNG2q6VKQg:sg8BVKTvPfEOadHqXaFtzE
TLSH
T10E664A07FCA419E9C1ADD1348A779553BB617C890B2123D32B90F6283FB6BE06D79364
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

555040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

408KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

980B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

2026-08-01_a8e8615c9f93d607efda28caed86d45a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic