General
- Target 2026-08-20_0b2d53a8a080e8a7c6abc0c9fe531e62_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch
- Size 10.9MB
- Sample260821-bdfrxaej3y
- SHA256 df748473f038b7d339f778e8d7647289edc9068bbc7da1f6bdc65cf271057b98
- MD5 0b2d53a8a080e8a7c6abc0c9fe531e62
- SHA1 e991652b7061c225ffb385af2dc385fb519baab9
- SHA512 5ba7167b79690adb7fb4d9ae2d438ecd1bd4769ea94d60d5bc93a361e2f5e1e41febb73b8663b19c6710d212843b62ff07e9b14b19dee189811975313d49ed30
- SSDEEP 98304:B9CX4acPdohda+3JeHjty7GOgdWO+TgXE/0l4DlzF82:BBfohdaFh15o/0l4Dl
- TLSH T11CB64A47E8A541A4C0EDD575C6669623BA713C984F3063D32F90FB282F76FD0AAB9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-20_0b2d53a8a080e8a7c6abc0c9fe531e62_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_0b2d53a8a080e8a7c6abc0c9fe531e62_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_0b2d53a8a080e8a7c6abc0c9fe531e62_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch
- Size 10.9MB
- SHA256 df748473f038b7d339f778e8d7647289edc9068bbc7da1f6bdc65cf271057b98
- MD5 0b2d53a8a080e8a7c6abc0c9fe531e62
- SHA1 e991652b7061c225ffb385af2dc385fb519baab9
- SHA512 5ba7167b79690adb7fb4d9ae2d438ecd1bd4769ea94d60d5bc93a361e2f5e1e41febb73b8663b19c6710d212843b62ff07e9b14b19dee189811975313d49ed30
- SSDEEP 98304:B9CX4acPdohda+3JeHjty7GOgdWO+TgXE/0l4DlzF82:BBfohdaFh15o/0l4Dl
- TLSH T11CB64A47E8A541A4C0EDD575C6669623BA713C984F3063D32F90FB282F76FD0AAB9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables referencing many IR and analysis tools
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
Detects executables referencing virtualization MAC addresses
-
UPX dump on OEP (original entry point)