2026-08-01_0542c4fac788ea973d4082c8e6d78ad5_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_0542c4fac788ea973d4082c8e6d78ad5_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 6.7MB
Sample260801-eergksdq4v
SHA256 fee7861dec251e9b397da89a5e25a6b964aaa3297a48ee9a7f3430084d619786
MD5 0542c4fac788ea973d4082c8e6d78ad5
SHA1 4263d8a124c6d688acecfc46acc614a61ca04ca8
SHA512 371668fe8ebb83dd2339de844b3f0907e5fd12ff3bc98cf3f9cbce0dd0a01ac7a60ca93b4a60a7311e541a9eeb752566342f868ba5a45b917882ab3d9ab7025e
SSDEEP 49152:sg+1BLxnKFfGgvEyvP2a98DuQ+bQs99WsiPK1KVNMAXjWXcuNNPXvQCVfNG2q6V9:sg8BVKTvPfEOaCHqXaFtME
TLSH
T189664A07FCA419E9C1ADD1348A779553BB617C890B2123D32B90F6283FB6BE06D79364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_0542c4fac788ea973d4082c8e6d78ad5_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-08-01_0542c4fac788ea973d4082c8e6d78ad5_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 6.7MB

2026-08-01_0542c4fac788ea973d4082c8e6d78ad5_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 fee7861dec251e9b397da89a5e25a6b964aaa3297a48ee9a7f3430084d619786
MD5 0542c4fac788ea973d4082c8e6d78ad5
SHA1 4263d8a124c6d688acecfc46acc614a61ca04ca8
SHA512 371668fe8ebb83dd2339de844b3f0907e5fd12ff3bc98cf3f9cbce0dd0a01ac7a60ca93b4a60a7311e541a9eeb752566342f868ba5a45b917882ab3d9ab7025e
SSDEEP 49152:sg+1BLxnKFfGgvEyvP2a98DuQ+bQs99WsiPK1KVNMAXjWXcuNNPXvQCVfNG2q6V9:sg8BVKTvPfEOaCHqXaFtME
TLSH
T189664A07FCA419E9C1ADD1348A779553BB617C890B2123D32B90F6283FB6BE06D79364
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

555040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

408KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

980B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

2026-08-01_0542c4fac788ea973d4082c8e6d78ad5_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic