2026-08-21_4bb11fd5c2c2bb2d8035c4436be5834c_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch

General

Target
2026-08-21_4bb11fd5c2c2bb2d8035c4436be5834c_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch
Size 13.3MB
Sample260821-e8th2agn2t
SHA256 23ff43f066be856d281147896694bcacfe270e5a32f8395f4c22e25eddc97e6b
MD5 4bb11fd5c2c2bb2d8035c4436be5834c
SHA1 88e13bccfd86ad7bf71ee1dad3a2fd9932465c87
SHA512 fa7c330c276eb1c0c6a0bd4a37bd6b624e062829810769b56dff946ac0ba81631cb1da6a063f83cd42be28cae759fe9a79051191caa29f19208e69b36d5888a3
SSDEEP 98304:OkoECqWUyHTwMJOg088/J/CZxKLCzKwUVCrtvfvXvYvzv+vpvrv3vLnyhU+c78Tv:Oem38ViDUVD++JTnv
TLSH
T1F4E63947ECA545A5C0EEC576C6669512BB313C894F3063E76B90FB242F37BD0AAB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_4bb11fd5c2c2bb2d8035c4436be5834c_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch

2026-08-21_4bb11fd5c2c2bb2d8035c4436be5834c_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch

.exe 13.3MB

SHA256 23ff43f066be856d281147896694bcacfe270e5a32f8395f4c22e25eddc97e6b
MD5 4bb11fd5c2c2bb2d8035c4436be5834c
SHA1 88e13bccfd86ad7bf71ee1dad3a2fd9932465c87
SHA512 fa7c330c276eb1c0c6a0bd4a37bd6b624e062829810769b56dff946ac0ba81631cb1da6a063f83cd42be28cae759fe9a79051191caa29f19208e69b36d5888a3
SSDEEP 98304:OkoECqWUyHTwMJOg088/J/CZxKLCzKwUVCrtvfvXvYvzv+vpvrv3vLnyhU+c78Tv:Oem38ViDUVD++JTnv
TLSH
T1F4E63947ECA545A5C0EEC576C6669512BB313C894F3063E76B90FB242F37BD0AAB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

556768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths