2026-08-03_1e3da51a9eb1e951cfe1043fe38f7d5b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_1e3da51a9eb1e951cfe1043fe38f7d5b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 19.8MB
Sample260804-p3kn2ser9s
SHA256 69cfbf277c6dcaadb9044dc4af0ab1665999a76c1442a333a5469f899bc8e469
MD5 1e3da51a9eb1e951cfe1043fe38f7d5b
SHA1 4e02a36de503701b848ebd84f70f19aaee26d49f
SHA512 cad64b51b2aeac455e1a179c5a4bcedbac53c571f6b1b5b705a1dd707dbd1006980da23bb20131697188848ad805d53399173ac4464965ae6e81cf7ad57b5fbe
SSDEEP 49152:hyP44AP3MBMK32xxG8PA2gNhjrATuGEs3XtysvPre6DPQ+c5EArNe71eBUrAOIaT:hyZws7P8yCyT+qc1e6ljQE
TLSH
T19E27F003FC6618F5C0ADE630897A96537F617C890B2123D71B90B6352F7ABD06EB9718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_1e3da51a9eb1e951cfe1043fe38f7d5b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-08-03_1e3da51a9eb1e951cfe1043fe38f7d5b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 19.8MB

2026-08-03_1e3da51a9eb1e951cfe1043fe38f7d5b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 69cfbf277c6dcaadb9044dc4af0ab1665999a76c1442a333a5469f899bc8e469
MD5 1e3da51a9eb1e951cfe1043fe38f7d5b
SHA1 4e02a36de503701b848ebd84f70f19aaee26d49f
SHA512 cad64b51b2aeac455e1a179c5a4bcedbac53c571f6b1b5b705a1dd707dbd1006980da23bb20131697188848ad805d53399173ac4464965ae6e81cf7ad57b5fbe
SSDEEP 49152:hyP44AP3MBMK32xxG8PA2gNhjrATuGEs3XtysvPre6DPQ+c5EArNe71eBUrAOIaT:hyZws7P8yCyT+qc1e6ljQE
TLSH
T19E27F003FC6618F5C0ADE630897A96537F617C890B2123D71B90B6352F7ABD06EB9718
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing virtualization MAC addresses
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

548000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16.7MB

Virtual Size

16.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

304KB

Virtual Size

32.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-08-03_1e3da51a9eb1e951cfe1043fe38f7d5b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic