2026-08-10_2af99d69bb8f433df98391f83d7ca9a0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_2af99d69bb8f433df98391f83d7ca9a0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 12.7MB
Sample260810-bc823astbw
SHA256 4964583b17614d8b6f1afc098f11dd946a7fac7deff0b21a16511d3c6efa3971
MD5 2af99d69bb8f433df98391f83d7ca9a0
SHA1 89af88b07442457cb6730dabaae00530e5166c81
SHA512 2feaf38ed2d8769da9f7cfe0c981ede192d5c2d0c2c192393bf7fb1a0963b671541e46930e151c0af5944a4ef49747475667f504511c0e59751027d7a313d16c
SSDEEP 98304:gpy4Nzvz7BO7/JTESYuVE+dFOFAhdbwzr/5/nMoIEjUt3F0NqO4Elb:gV5vz7BO719O+POFywzrYtKl
TLSH
T1D5D648D7ECA014E8C0ADD37586629663BB617C484B2563D75A60FE283F37BD0ADB6304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_2af99d69bb8f433df98391f83d7ca9a0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-08-10_2af99d69bb8f433df98391f83d7ca9a0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 12.7MB

2026-08-10_2af99d69bb8f433df98391f83d7ca9a0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 4964583b17614d8b6f1afc098f11dd946a7fac7deff0b21a16511d3c6efa3971
MD5 2af99d69bb8f433df98391f83d7ca9a0
SHA1 89af88b07442457cb6730dabaae00530e5166c81
SHA512 2feaf38ed2d8769da9f7cfe0c981ede192d5c2d0c2c192393bf7fb1a0963b671541e46930e151c0af5944a4ef49747475667f504511c0e59751027d7a313d16c
SSDEEP 98304:gpy4Nzvz7BO7/JTESYuVE+dFOFAhdbwzr/5/nMoIEjUt3F0NqO4Elb:gV5vz7BO719O+POFywzrYtKl
TLSH
T1D5D648D7ECA014E8C0ADD37586629663BB617C484B2563D75A60FE283F37BD0ADB6304
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

557216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.9MB

Virtual Size

6.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

549KB

Virtual Size

32.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

117KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-08-10_2af99d69bb8f433df98391f83d7ca9a0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic