2026-08-04_3a5688720a684180f248d6ee1e76e5b3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_3a5688720a684180f248d6ee1e76e5b3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz
Size 57.2MB
Sample260805-bfmcgavfkb
SHA256 339c8c4315e546c100e8b1559a8463d9e1da11e84e08b24d60c196f4dc536513
MD5 3a5688720a684180f248d6ee1e76e5b3
SHA1 f09e87a06f348a02c3548418ba31fb3024a22bf7
SHA512 1420f90d00899730c63ed9267326f0535eea3a5f637092a91dc6feaf30aa105398580d7a7f7aae02bb2488d365866c98828248f2c984333c752c7b693225e3f4
SSDEEP 196608:KP2D10Duvz+v3ejfc5VZ/77YjloJlfSql58aLkDm57C/n2ynFABvv:KuD10sifejkzpUjSTfXrj5W/n2yn2
TLSH
T178D7E737F62504E6C8AFA13D406A11736F6D785087A0E2F75B406918FF39AE0AA75F4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_3a5688720a684180f248d6ee1e76e5b3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz

File Explorer

2026-08-04_3a5688720a684180f248d6ee1e76e5b3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz

.exe 57.2MB

2026-08-04_3a5688720a684180f248d6ee1e76e5b3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz

IMPHASH 70df50797f7a85a271c38135c5679c40
SHA256 339c8c4315e546c100e8b1559a8463d9e1da11e84e08b24d60c196f4dc536513
MD5 3a5688720a684180f248d6ee1e76e5b3
SHA1 f09e87a06f348a02c3548418ba31fb3024a22bf7
SHA512 1420f90d00899730c63ed9267326f0535eea3a5f637092a91dc6feaf30aa105398580d7a7f7aae02bb2488d365866c98828248f2c984333c752c7b693225e3f4
SSDEEP 196608:KP2D10Duvz+v3ejfc5VZ/77YjloJlfSql58aLkDm57C/n2ynFABvv:KuD10sifejkzpUjSTfXrj5W/n2yn2
TLSH
T178D7E737F62504E6C8AFA13D406A11736F6D785087A0E2F75B406918FF39AE0AA75F4C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

603264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

14.8MB

Virtual Size

14.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40.4MB

Virtual Size

40.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.1MB

Virtual Size

33.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

426KB

Virtual Size

425KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

359KB

Virtual Size

359KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

2026-08-04_3a5688720a684180f248d6ee1e76e5b3_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz

kernel32

generic