General
- Target 2026-08-17_44a894cd5d048ef8b03fb4e64f2a5b83_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch
- Size 10.6MB
- Sample260818-atw86aee99
- SHA256 45661b6463e2f522b2583e95786c8a0d5a40d20843bfae29cdc280fd8829a234
- MD5 44a894cd5d048ef8b03fb4e64f2a5b83
- SHA1 963a64c621a5593a17a891802fdfb7ec9bb94da7
- SHA512 f97975c40641500fc25a578668868fd791defe8e968a5a4334874e0e3f93ef8e10dc83fffd75075725952b0f4f7762b29aaf195569bf93ac7a73a0070f63ec02
- SSDEEP 98304:mGypvejyAgTDL12WuU0BX4QwDSmjIVRDRGvEosSzJK9QV/M:mFAgT4IfSAIVRDRGsosSz/V/M
- TLSH T111B64A47F8A506A5C0EED575C6629263BE713C994F3063D32B90F7282F76BD0A9B9700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-17_44a894cd5d048ef8b03fb4e64f2a5b83_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_44a894cd5d048ef8b03fb4e64f2a5b83_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-17_44a894cd5d048ef8b03fb4e64f2a5b83_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch
- Size 10.6MB
- SHA256 45661b6463e2f522b2583e95786c8a0d5a40d20843bfae29cdc280fd8829a234
- MD5 44a894cd5d048ef8b03fb4e64f2a5b83
- SHA1 963a64c621a5593a17a891802fdfb7ec9bb94da7
- SHA512 f97975c40641500fc25a578668868fd791defe8e968a5a4334874e0e3f93ef8e10dc83fffd75075725952b0f4f7762b29aaf195569bf93ac7a73a0070f63ec02
- SSDEEP 98304:mGypvejyAgTDL12WuU0BX4QwDSmjIVRDRGvEosSzJK9QV/M:mFAgT4IfSAIVRDRGsosSz/V/M
- TLSH T111B64A47F8A506A5C0EED575C6629263BE713C994F3063D32B90F7282F76BD0A9B9700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables referencing many IR and analysis tools
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
Detects executables referencing virtualization MAC addresses
-
UPX dump on OEP (original entry point)