dd6a27ec08a57af07df64c074e408e8ff4c81b623ce6cadb25756a17090b1a33

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 22:10

Target
2026-08-17_5e32362f084655c96c29374c09bada4a_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch.exe
Size 36.3MB
Sample260817-13phsa1ake
SHA256 dd6a27ec08a57af07df64c074e408e8ff4c81b623ce6cadb25756a17090b1a33
MD5 5e32362f084655c96c29374c09bada4a
SHA1 05e55fdd64d56fc4954c232a5ecf206e140e3245
SHA512 7c0343fbf1b40199bf7719e4fc32fa964b775e1696e48b32edc6bce4c57ef3822749314b902dd82e2da01cd4c0a9101170cd2e58a8ab8c2861c0af53940d8ead
SSDEEP 196608:7jpVWjDQmr9NU617qn91UcyNeZDZlL4rYFR+qp:7lW3oyPcyNelkMx
TLSH
T177878D27FA9455A8E5BEC134CA3795127BB57C8A433023D72B54F5202BB3BD0A5BE390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/memory/2436-0-0x00007FF7D4720000-0x00007FF7D8465000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/2436-0-0x00007FF7D4720000-0x00007FF7D8465000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2436-0-0x00007FF7D4720000-0x00007FF7D8465000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\2026-08-17_5e32362f084655c96c29374c09bada4a_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_5e32362f084655c96c29374c09bada4a_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch.exe"
1⤵
PID:2436

memory/2436-0-0x00007FF7D4720000-0x00007FF7D8465000-memory.dmp

Download

memory/2436-1-0x00007FF7D4720000-0x00007FF7D8465000-memory.dmp

Download