2026-08-09_858f4c6c83490c5bcead409dfc32c4e7_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_858f4c6c83490c5bcead409dfc32c4e7_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 10.4MB
Sample260809-remjvasvby
SHA256 78e5a708249e9bee89e6b972ba561773cae5ce9729c6182fdbbb3a1f1c19c30e
MD5 858f4c6c83490c5bcead409dfc32c4e7
SHA1 58211c41ca7751fd912a3843b57ce7629d759207
SHA512 34be8d1e80b248e2240342276956466f80aad91ee6037b4bb212347caf38d51920e8aca9935ac69ea9393293f81a994656672f92bf194af0db1244a23c4412e9
SSDEEP 98304:GUwZEpD/8YSLmNdnJXe7rLkzc8v4mdzMbsVHpKgsL4OxbfB/Xzt6Mh+plr+/DAxt:GLM/8GsrLkQ8v4mdBLIy
TLSH
T14BB63A57ECA552E8C0AED175C6269523BB713C885B30A3D36B60F6242F37BD0ADB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_858f4c6c83490c5bcead409dfc32c4e7_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-08-09_858f4c6c83490c5bcead409dfc32c4e7_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 10.4MB

2026-08-09_858f4c6c83490c5bcead409dfc32c4e7_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 78e5a708249e9bee89e6b972ba561773cae5ce9729c6182fdbbb3a1f1c19c30e
MD5 858f4c6c83490c5bcead409dfc32c4e7
SHA1 58211c41ca7751fd912a3843b57ce7629d759207
SHA512 34be8d1e80b248e2240342276956466f80aad91ee6037b4bb212347caf38d51920e8aca9935ac69ea9393293f81a994656672f92bf194af0db1244a23c4412e9
SSDEEP 98304:GUwZEpD/8YSLmNdnJXe7rLkzc8v4mdzMbsVHpKgsL4OxbfB/Xzt6Mh+plr+/DAxt:GLM/8GsrLkQ8v4mdBLIy
TLSH
T14BB63A57ECA552E8C0AED175C6269523BB713C885B30A3D36B60F6242F37BD0ADB9740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

557792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.8MB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

486KB

Virtual Size

32.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

118KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-08-09_858f4c6c83490c5bcead409dfc32c4e7_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic