General
- Target 2026-08-15_6d002cc3aa3d7b7809b23a5887230db2_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch
- Size 10.5MB
- Sample260815-1e319sgr2y
- SHA256 f8d3288d75ff70dca74b6605dd041697f31a50e3382db6fe1eab4a943822e1cf
- MD5 6d002cc3aa3d7b7809b23a5887230db2
- SHA1 9da135f7134b14aaa42357912dc41a3ab2d98923
- SHA512 2056be095fb25fe1a80844ab62a9a259e096fff26dbdb1d2a3add68b072a62702f6d49f09c26251427b8cf981a8ee42000c576b759dba3ce7167019c74b2e5c2
- SSDEEP 98304:CTfWQmz/1vDpjynNZ2jwQUkusxDEdKar59v:c8z/1pCwZ6dKaf
- TLSH T16CB64A47E8A501A5C1ED9175C6269663BF713C994F3023D32FA0FB282F76BD0A9B9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-15_6d002cc3aa3d7b7809b23a5887230db2_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_6d002cc3aa3d7b7809b23a5887230db2_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-15_6d002cc3aa3d7b7809b23a5887230db2_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch
- Size 10.5MB
- SHA256 f8d3288d75ff70dca74b6605dd041697f31a50e3382db6fe1eab4a943822e1cf
- MD5 6d002cc3aa3d7b7809b23a5887230db2
- SHA1 9da135f7134b14aaa42357912dc41a3ab2d98923
- SHA512 2056be095fb25fe1a80844ab62a9a259e096fff26dbdb1d2a3add68b072a62702f6d49f09c26251427b8cf981a8ee42000c576b759dba3ce7167019c74b2e5c2
- SSDEEP 98304:CTfWQmz/1vDpjynNZ2jwQUkusxDEdKar59v:c8z/1pCwZ6dKaf
- TLSH T16CB64A47E8A501A5C1ED9175C6269663BF713C994F3023D32FA0FB282F76BD0A9B9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables referencing many IR and analysis tools
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
Detects executables referencing virtualization MAC addresses
-
UPX dump on OEP (original entry point)