General
- Target 2026-08-10_2269a5a9445b76fc147c6b3720b24c7e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.5MB
- Sample260810-bdpd2syckc
- SHA256 c8228eb840e3869d3bff564010e3960a93deea4113359a3b8ca9f5614ef59d47
- MD5 2269a5a9445b76fc147c6b3720b24c7e
- SHA1 37934dd919538201b3f05ca3601b55856cd6ed7d
- SHA512 686c6dbbd30ecde20ef775a0679e1af833987e62c95e5d80fb259a58e8dc23e7687c94008e9daa71763b3d89ed13898968b92f6f4cb425dbf069699d0f534cbe
- SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8r:T6BJUoROZfIA8Xf8xumvBh8huTEEm4
- TLSH T131665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_2269a5a9445b76fc147c6b3720b24c7e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_2269a5a9445b76fc147c6b3720b24c7e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_2269a5a9445b76fc147c6b3720b24c7e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.5MB
- SHA256 c8228eb840e3869d3bff564010e3960a93deea4113359a3b8ca9f5614ef59d47
- MD5 2269a5a9445b76fc147c6b3720b24c7e
- SHA1 37934dd919538201b3f05ca3601b55856cd6ed7d
- SHA512 686c6dbbd30ecde20ef775a0679e1af833987e62c95e5d80fb259a58e8dc23e7687c94008e9daa71763b3d89ed13898968b92f6f4cb425dbf069699d0f534cbe
- SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8r:T6BJUoROZfIA8Xf8xumvBh8huTEEm4
- TLSH T131665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application