2263530386a87f8706b7fdff4f403b70c01d7efc2d0379c91243b9d165cb760d

General

Target
2026-08-18_caa9f494b994c4e18bd416c70955b8b2_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
Size 11.2MB
Sample260818-fet35sfd57
SHA256 2263530386a87f8706b7fdff4f403b70c01d7efc2d0379c91243b9d165cb760d
MD5 caa9f494b994c4e18bd416c70955b8b2
SHA1 045b928a1aeef35451e2471ae9a76bd4a4c4ea67
SHA512 4c4d74e3e51c01ea6006a059112f6d8b03c4ea6fedffdb36119638e90bea2eb489e67182d7614ba30337b134de353d687c9088dd8ff07e04c4bffcb9da104dbb
SSDEEP 98304:CdR5jU/R6O1B9kzfLK3z/Cpnf3MDEzmEYhZEG:C5QNmpf3MDGPG
TLSH
T186C63947ECB511E9C0AEC5B5C6269593BB723C884B3163E35B50F6252F32BD0AEB9710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-18_caa9f494b994c4e18bd416c70955b8b2_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
- Size 11.2MB
- SHA256 2263530386a87f8706b7fdff4f403b70c01d7efc2d0379c91243b9d165cb760d
- MD5 caa9f494b994c4e18bd416c70955b8b2
- SHA1 045b928a1aeef35451e2471ae9a76bd4a4c4ea67
- SHA512 4c4d74e3e51c01ea6006a059112f6d8b03c4ea6fedffdb36119638e90bea2eb489e67182d7614ba30337b134de353d687c9088dd8ff07e04c4bffcb9da104dbb
- SSDEEP 98304:CdR5jU/R6O1B9kzfLK3z/Cpnf3MDEzmEYhZEG:C5QNmpf3MDGPG
- TLSH
  T186C63947ECB511E9C0AEC5B5C6269593BB723C884B3163E35B50F6252F32BD0AEB9710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing artifacts associated with disabling Widnows Defender
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Detects executables referencing many IR and analysis tools
- Detects executables referencing virtualization MAC addresses
- detects Windows exceutables potentially bypassing UAC using eventvwr.exe
- detects Windows exceutables potentially bypassing UAC using fodhelper.exe
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2