General
- Target 2026-08-10_5467ab967fd70730d97314465a3f7efb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.5MB
- Sample260810-pc6tlayanc
- SHA256 4e31df1c28a47053b9fd43cb615697b807452520f7e510313684e51550f47e26
- MD5 5467ab967fd70730d97314465a3f7efb
- SHA1 2f0fde04954ed867ef1efd279d6869f23d78790c
- SHA512 414b14385d8ab03633aba48be7f6ab37082b52c62b10cbc9c70a856c095fd233dfc0513dffd2f0066ca58aca69e3b637686d457152d18748532b06f88e59f501
- SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f89:T6BJUoROZfIA8Xf8xumvBh8huTEEmr0
- TLSH T1C1665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_5467ab967fd70730d97314465a3f7efb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_5467ab967fd70730d97314465a3f7efb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_5467ab967fd70730d97314465a3f7efb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.5MB
- SHA256 4e31df1c28a47053b9fd43cb615697b807452520f7e510313684e51550f47e26
- MD5 5467ab967fd70730d97314465a3f7efb
- SHA1 2f0fde04954ed867ef1efd279d6869f23d78790c
- SHA512 414b14385d8ab03633aba48be7f6ab37082b52c62b10cbc9c70a856c095fd233dfc0513dffd2f0066ca58aca69e3b637686d457152d18748532b06f88e59f501
- SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f89:T6BJUoROZfIA8Xf8xumvBh8huTEEmr0
- TLSH T1C1665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application