2026-08-08_c46717e639765257a24deaad918ff07d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_c46717e639765257a24deaad918ff07d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 20.3MB
Sample260808-c9fbpayeja
SHA256 f6d0bb89111c20020025d98c0885e92b379783afab015e405d50b8660930ef42
MD5 c46717e639765257a24deaad918ff07d
SHA1 91acb9aa8fc7899c59d5301a763659470a390273
SHA512 e702a57e9e1e6a2b76af9c7d3b4809e8883cb7d4bd10d9cb692deff416d49a0b7ee2c879329dcdfedf2e33a1b39e1cdaac622dc9a0f36fa2f188671ea523e6d0
SSDEEP 98304:ocmQD05RlZRx/MTTA7FfCAjCpaQz65JAt/M65AnLqHgGP+tZEKGQ6qWT0Z2VYC1b:VzI5R2ZyCpaQ6DnA/PomvQUM2VYCG6j
TLSH
T135274BA7F89410D9C5ADD538C962A1A2BB717C48872033D31F60FA296F727D06FBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing credit card regular expressions 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_CC_Regex

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_c46717e639765257a24deaad918ff07d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-08-08_c46717e639765257a24deaad918ff07d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 20.3MB

2026-08-08_c46717e639765257a24deaad918ff07d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 f6d0bb89111c20020025d98c0885e92b379783afab015e405d50b8660930ef42
MD5 c46717e639765257a24deaad918ff07d
SHA1 91acb9aa8fc7899c59d5301a763659470a390273
SHA512 e702a57e9e1e6a2b76af9c7d3b4809e8883cb7d4bd10d9cb692deff416d49a0b7ee2c879329dcdfedf2e33a1b39e1cdaac622dc9a0f36fa2f188671ea523e6d0
SSDEEP 98304:ocmQD05RlZRx/MTTA7FfCAjCpaQz65JAt/M65AnLqHgGP+tZEKGQ6qWT0Z2VYC1b:VzI5R2ZyCpaQ6DnA/PomvQUM2VYCG6j
TLSH
T135274BA7F89410D9C5ADD538C962A1A2BB717C48872033D31F60FA296F727D06FBA750
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing credit card regular expressions
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

559904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

8.7MB

Virtual Size

8.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10.4MB

Virtual Size

10.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

886KB

Virtual Size

32.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

191KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

201KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-08-08_c46717e639765257a24deaad918ff07d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic