General
- Target 2026-08-18_830f77af3e485841b5d9eea4cd30915d_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch
- Size 10.9MB
- Sample260818-l3fhjs1vbv
- SHA256 eea5a9ea27f6818ddb9b8e4f9af7ad0690361d593d9b7be84ab94927e5711c4c
- MD5 830f77af3e485841b5d9eea4cd30915d
- SHA1 0d3b06e40ce292da6fc56562d6db53f59db4fe91
- SHA512 f9c445b6cfecf9465c2ff7c5175b1a969a43f5f6ddd519177f3ff3f4519eac235c4d575a8d90ed13dafba8359bc59e364327285c46fb2e3248f9a2904fd28d92
- SSDEEP 98304:ExeXe9W7YYdt1VdarsL0pHqeiwxbqXDj6E+UlOZFWF8J0:ExeEAdt1S1cyqX+UlOZF
- TLSH T1AFB64A4BF8A541E4C0ADD535CA269623BB713C984F3163D32B50F7282F76BD0AAB9750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-18_830f77af3e485841b5d9eea4cd30915d_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_830f77af3e485841b5d9eea4cd30915d_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-18_830f77af3e485841b5d9eea4cd30915d_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch
- Size 10.9MB
- SHA256 eea5a9ea27f6818ddb9b8e4f9af7ad0690361d593d9b7be84ab94927e5711c4c
- MD5 830f77af3e485841b5d9eea4cd30915d
- SHA1 0d3b06e40ce292da6fc56562d6db53f59db4fe91
- SHA512 f9c445b6cfecf9465c2ff7c5175b1a969a43f5f6ddd519177f3ff3f4519eac235c4d575a8d90ed13dafba8359bc59e364327285c46fb2e3248f9a2904fd28d92
- SSDEEP 98304:ExeXe9W7YYdt1VdarsL0pHqeiwxbqXDj6E+UlOZFWF8J0:ExeEAdt1S1cyqX+UlOZF
- TLSH T1AFB64A4BF8A541E4C0ADD535CA269623BB713C984F3163D32B50F7282F76BD0AAB9750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables referencing many IR and analysis tools
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
Detects executables referencing virtualization MAC addresses
-
UPX dump on OEP (original entry point)