2026-08-03_174f1653e4b3d074fd73a2cbd112b2a5_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_174f1653e4b3d074fd73a2cbd112b2a5_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 6.6MB
Sample260804-dwy3ba1dld
SHA256 b30240f32fd1d422281c03337dbf9b3857d7fd7c7f235401057deb76e8d3284b
MD5 174f1653e4b3d074fd73a2cbd112b2a5
SHA1 7d92791cd320dd0136cd3f7cfb095ee70acec6e6
SHA512 c681dbaa589a67023853f13fc0a351208e1204892d713408c48fa947fd485524c0f956807b59d80057ce92ad0f66d24ce3504dc5c485278169bf1f05649a33ad
SSDEEP 49152:cAhueEUG/I7u+/t81Fp1JNvpldJuFUhZZ6sGT6YLsFNSjoiuvzmVd5G2qSKQK1KX:cS7ZoeieYG841qnAw35oPmE
TLSH
T1D1664907ECA915E8C0ADD1718A7396527B317C885B3127D32B90FA243F76BE06EB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_174f1653e4b3d074fd73a2cbd112b2a5_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-08-03_174f1653e4b3d074fd73a2cbd112b2a5_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 6.6MB

2026-08-03_174f1653e4b3d074fd73a2cbd112b2a5_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 b30240f32fd1d422281c03337dbf9b3857d7fd7c7f235401057deb76e8d3284b
MD5 174f1653e4b3d074fd73a2cbd112b2a5
SHA1 7d92791cd320dd0136cd3f7cfb095ee70acec6e6
SHA512 c681dbaa589a67023853f13fc0a351208e1204892d713408c48fa947fd485524c0f956807b59d80057ce92ad0f66d24ce3504dc5c485278169bf1f05649a33ad
SSDEEP 49152:cAhueEUG/I7u+/t81Fp1JNvpldJuFUhZZ6sGT6YLsFNSjoiuvzmVd5G2qSKQK1KX:cS7ZoeieYG841qnAw35oPmE
TLSH
T1D1664907ECA915E8C0ADD1718A7396527B317C885B3127D32B90FA243F76BE06EB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

555040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

408KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

2026-08-03_174f1653e4b3d074fd73a2cbd112b2a5_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic