2026-08-04_9905d478417dfdeb7909f539fff3b704_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_9905d478417dfdeb7909f539fff3b704_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 10.3MB
Sample260804-gxbj7aeb76
SHA256 f5b9a652da527a12841973ef415cb7f1bf0f818373d25567769dc1f22da73e31
MD5 9905d478417dfdeb7909f539fff3b704
SHA1 2fe7d2a21de3d9d6882ff53d754be114c3625420
SHA512 9c54a33e51a3df86790458abb8c751ab860fa47b98ab6e6bca4a8dae4f9ad84cc406c4360c4c22260cac1e5ab34948ece9f0e214128e8b4fb3b4abdcb0799ede
SSDEEP 98304:O/Ozwr82q4n/PWUl+QwkxUgY+ficLv/smmOrfvfvUvhvkv+vpvkv3vE2yx+vux0M:O8GclensdZgWx0M
TLSH
T1F1B62847E8A546E5C0AEC535C66695137B713C898F3063E76B50FA242F33BE0AEB9704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_9905d478417dfdeb7909f539fff3b704_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-08-04_9905d478417dfdeb7909f539fff3b704_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 10.3MB

2026-08-04_9905d478417dfdeb7909f539fff3b704_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 f5b9a652da527a12841973ef415cb7f1bf0f818373d25567769dc1f22da73e31
MD5 9905d478417dfdeb7909f539fff3b704
SHA1 2fe7d2a21de3d9d6882ff53d754be114c3625420
SHA512 9c54a33e51a3df86790458abb8c751ab860fa47b98ab6e6bca4a8dae4f9ad84cc406c4360c4c22260cac1e5ab34948ece9f0e214128e8b4fb3b4abdcb0799ede
SSDEEP 98304:O/Ozwr82q4n/PWUl+QwkxUgY+ficLv/smmOrfvfvUvhvkv+vpvkv3vE2yx+vux0M:O8GclensdZgWx0M
TLSH
T1F1B62847E8A546E5C0AEC535C66695137B713C898F3063E76B50FA242F33BE0AEB9704
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

556768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

556KB

Virtual Size

32.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-08-04_9905d478417dfdeb7909f539fff3b704_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic