2026-08-02_5cd863b7a62756485534a564e3abb29c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_5cd863b7a62756485534a564e3abb29c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 10.3MB
Sample260802-dmpsaacl4x
SHA256 4efcd77cf64ece6f5ed6c7c5e11127bf05852bce6a05c0bcee3874db930e6c2f
MD5 5cd863b7a62756485534a564e3abb29c
SHA1 64c3cf12dcf40c198ff1398e363b162cc5cb6680
SHA512 83af81e763ffdd2399542c06a07d3a6dbbcbb7ea15da3cb24833bc9dcb8933771e9d20cc61ff5870313462dc5eadbec6521a2ecd07279332a07360c062080950
SSDEEP 98304:GNFnoLiJU/P/rj+lG1KM36kgrOnzFTKxl8rgvfvCvZvCGgv+vpvrv3vy2yh0Q4cr:GXby/LBpClLR+STIw7
TLSH
T195B63947ECA541E5C0AEC575CA669552BB713C884F3063D76B90BB242F37BD0AEBA700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_5cd863b7a62756485534a564e3abb29c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-08-02_5cd863b7a62756485534a564e3abb29c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 10.3MB

2026-08-02_5cd863b7a62756485534a564e3abb29c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 4efcd77cf64ece6f5ed6c7c5e11127bf05852bce6a05c0bcee3874db930e6c2f
MD5 5cd863b7a62756485534a564e3abb29c
SHA1 64c3cf12dcf40c198ff1398e363b162cc5cb6680
SHA512 83af81e763ffdd2399542c06a07d3a6dbbcbb7ea15da3cb24833bc9dcb8933771e9d20cc61ff5870313462dc5eadbec6521a2ecd07279332a07360c062080950
SSDEEP 98304:GNFnoLiJU/P/rj+lG1KM36kgrOnzFTKxl8rgvfvCvZvCGgv+vpvrv3vy2yh0Q4cr:GXby/LBpClLR+STIw7
TLSH
T195B63947ECA541E5C0AEC575CA669552BB713C884F3063D76B90BB242F37BD0AEBA700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

556768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

556KB

Virtual Size

32.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-08-02_5cd863b7a62756485534a564e3abb29c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic