2026-08-10_3d3f2110445b02e89a923028c024485d_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_snatch

General

Target
2026-08-10_3d3f2110445b02e89a923028c024485d_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_snatch
Size 18.3MB
Sample260810-bb663sgm6v
SHA256 cae9023e47fff316bcd3fe1d8131c7cc8de92f18705453cfa6d5b45c1d6e6c14
MD5 3d3f2110445b02e89a923028c024485d
SHA1 2a92a0a038a7bb3b75877a691fa4770a2800405f
SHA512 4d89894492cc5b8c448bc31536dc58b9d72349705172bba95bb7f16a9e66d40f350e508a193e519f5f727f68dd8420a9bb09c676291f00609589293ff7001423
SSDEEP 98304:JTQE8wVbIVod0yCo7NU70/F7zVKu4wqSZgw89Ups4w7J/QjEQelC92EVP:JTUwtUG/YSt89Ups4w7J/Q6C9zVP
TLSH
T112175941FE87A5F1D54B093206A7622F3B342C844B28C787FB4CBA29FB777901876659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Patched UPX-packed file 1 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
sample	patched_upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_3d3f2110445b02e89a923028c024485d_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_snatch

2026-08-10_3d3f2110445b02e89a923028c024485d_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_snatch

.exe 18.3MB

SHA256 cae9023e47fff316bcd3fe1d8131c7cc8de92f18705453cfa6d5b45c1d6e6c14
MD5 3d3f2110445b02e89a923028c024485d
SHA1 2a92a0a038a7bb3b75877a691fa4770a2800405f
SHA512 4d89894492cc5b8c448bc31536dc58b9d72349705172bba95bb7f16a9e66d40f350e508a193e519f5f727f68dd8420a9bb09c676291f00609589293ff7001423
SSDEEP 98304:JTQE8wVbIVod0yCo7NU70/F7zVKu4wqSZgw89Ups4w7J/QjEQelC92EVP:JTUwtUG/YSt89Ups4w7J/Q6C9zVP
TLSH
T112175941FE87A5F1D54B093206A7622F3B342C844B28C787FB4CBA29FB777901876659
MD5 SHA1 SHA512 SSDEEP TLSH

UPX dump on OEP (original entry point)
Patched UPX-packed file

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

595968

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths