2026-08-12_fbe57687241f729f851f36515268d443_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch

General

Target
2026-08-12_fbe57687241f729f851f36515268d443_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch
Size 9.7MB
Sample260812-1jsfbseh72
SHA256 1157e6087a05d02964dbfe3294e9d3973febb8398b5031e66ee1bb45b013ec9c
MD5 fbe57687241f729f851f36515268d443
SHA1 3b7c5ef1c6a73d28a80a8b204d077ccb6888f139
SHA512 b44bed9d692b8dd287bbe29bbcc409e1e37ded247089aea96c46c3a03a0daeb0e87cf1c19e8d7aa0ae7ba9bcfc77b2414871172d9657757f6c8ea3d8f5cd1723
SSDEEP 98304:SLMmyWPF3kfyJPA7PpzLonVBeWdcKB7YF7C9iSnikAYdQJ7Eu:ScWN3HARonVxdz8F+0EeJo
TLSH
T1EEA62805FECB59F5F907583111ABA22F63356D058B28CBC7EB547E2AF8372E12936205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Patched UPX-packed file 1 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
sample	patched_upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_fbe57687241f729f851f36515268d443_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch

2026-08-12_fbe57687241f729f851f36515268d443_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch

.exe 9.7MB

SHA256 1157e6087a05d02964dbfe3294e9d3973febb8398b5031e66ee1bb45b013ec9c
MD5 fbe57687241f729f851f36515268d443
SHA1 3b7c5ef1c6a73d28a80a8b204d077ccb6888f139
SHA512 b44bed9d692b8dd287bbe29bbcc409e1e37ded247089aea96c46c3a03a0daeb0e87cf1c19e8d7aa0ae7ba9bcfc77b2414871172d9657757f6c8ea3d8f5cd1723
SSDEEP 98304:SLMmyWPF3kfyJPA7PpzLonVBeWdcKB7YF7C9iSnikAYdQJ7Eu:ScWN3HARonVxdz8F+0EeJo
TLSH
T1EEA62805FECB59F5F907583111ABA22F63356D058B28CBC7EB547E2AF8372E12936205
MD5 SHA1 SHA512 SSDEEP TLSH

UPX dump on OEP (original entry point)
Patched UPX-packed file

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

515600

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths