2026-08-05_900f41d04cad0fd8bcc582be66e9b2b0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_900f41d04cad0fd8bcc582be66e9b2b0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 6.7MB
Sample260805-qb69eaba76
SHA256 31987bc4c758e253231f795124cdc70c7047922030974f9dc1a10d7003a5dca5
MD5 900f41d04cad0fd8bcc582be66e9b2b0
SHA1 3fba5a9c01969c8c6d21a92e366fee52e8933040
SHA512 f5ad283e9cec82cfda1fbb230d08fb1e74d020f2740bed2c4a9a0019b2402381851b48503c618375e48189e87009c8e311f7b0d6b29b6f237870f01752b2e762
SSDEEP 49152:QsrszJrOxyY3zMYD6N7kTyOLI/FcdIluVVcFw2BbQ0Y6NyLvtlVfbpd3ZBKQK1K/:QsCfa+luKpH3NyRZym3AE
TLSH
T1DA664A07ECA515E9C1ADD23589729153BF62BC490B2123D72B50F6383F76BE0AEB9344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_900f41d04cad0fd8bcc582be66e9b2b0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-08-05_900f41d04cad0fd8bcc582be66e9b2b0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 6.7MB

2026-08-05_900f41d04cad0fd8bcc582be66e9b2b0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 31987bc4c758e253231f795124cdc70c7047922030974f9dc1a10d7003a5dca5
MD5 900f41d04cad0fd8bcc582be66e9b2b0
SHA1 3fba5a9c01969c8c6d21a92e366fee52e8933040
SHA512 f5ad283e9cec82cfda1fbb230d08fb1e74d020f2740bed2c4a9a0019b2402381851b48503c618375e48189e87009c8e311f7b0d6b29b6f237870f01752b2e762
SSDEEP 49152:QsrszJrOxyY3zMYD6N7kTyOLI/FcdIluVVcFw2BbQ0Y6NyLvtlVfbpd3ZBKQK1K/:QsCfa+luKpH3NyRZym3AE
TLSH
T1DA664A07ECA515E9C1ADD23589729153BF62BC490B2123D72B50F6383F76BE0AEB9344
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

556608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

408KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

2026-08-05_900f41d04cad0fd8bcc582be66e9b2b0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic