General
- Target 2026-08-10_8adc74249dfb4c6ec0a5d72635be5bda_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.5MB
- Sample260810-e3s1ba1dng
- SHA256 2a45975ba980cc72c51b872a35ec36a200e407158bcf5cce4a0f39a1a3658955
- MD5 8adc74249dfb4c6ec0a5d72635be5bda
- SHA1 04cde80059fa3b2eb5d55da54f8b27185d64cd08
- SHA512 4027cb88d5bed1cf61c9b73f5dbc994d0be8f8ef830ebbbdcffa4d57365eeacdd3487d01735460636a8bde8cfdad89841116275310564ac2b18710691d7366a6
- SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8m:T6BJUoROZfIA8Xf8xumvBh8huTEEml
- TLSH T170665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_8adc74249dfb4c6ec0a5d72635be5bda_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_8adc74249dfb4c6ec0a5d72635be5bda_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_8adc74249dfb4c6ec0a5d72635be5bda_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.5MB
- SHA256 2a45975ba980cc72c51b872a35ec36a200e407158bcf5cce4a0f39a1a3658955
- MD5 8adc74249dfb4c6ec0a5d72635be5bda
- SHA1 04cde80059fa3b2eb5d55da54f8b27185d64cd08
- SHA512 4027cb88d5bed1cf61c9b73f5dbc994d0be8f8ef830ebbbdcffa4d57365eeacdd3487d01735460636a8bde8cfdad89841116275310564ac2b18710691d7366a6
- SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8m:T6BJUoROZfIA8Xf8xumvBh8huTEEml
- TLSH T170665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application