General
- Target 2026-08-21_da58dbc42c0ec3134e50435884c35a49_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch
- Size 10.9MB
- Sample260821-eepb8awves
- SHA256 2b8f5a3a15325dbf15ae7b179319ae1d665a3b113f0ec5f0d8354169f1ab426a
- MD5 da58dbc42c0ec3134e50435884c35a49
- SHA1 232afef8fc972b0741ea75fa51c2fb5764eec670
- SHA512 14b961871bc9656e64cdec41b001e1bf1bde42ae8afca04d8cc7b11489a2001c6a409889cb06082344faba31c94126c1d1a202740a4a3bb857008d534f36a060
- SSDEEP 98304:PtMFgjzdsMZFPTPIT7W4q9Fjba0UANPUELWsWsn8Dm:PU6dsM8W4OGetLWsW
- TLSH T1D5B64B47EDA541E4C0AED535C6669623BA713C984F3063D36F90FB282F76BD0AAB5700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-21_da58dbc42c0ec3134e50435884c35a49_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_da58dbc42c0ec3134e50435884c35a49_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-21_da58dbc42c0ec3134e50435884c35a49_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch
- Size 10.9MB
- SHA256 2b8f5a3a15325dbf15ae7b179319ae1d665a3b113f0ec5f0d8354169f1ab426a
- MD5 da58dbc42c0ec3134e50435884c35a49
- SHA1 232afef8fc972b0741ea75fa51c2fb5764eec670
- SHA512 14b961871bc9656e64cdec41b001e1bf1bde42ae8afca04d8cc7b11489a2001c6a409889cb06082344faba31c94126c1d1a202740a4a3bb857008d534f36a060
- SSDEEP 98304:PtMFgjzdsMZFPTPIT7W4q9Fjba0UANPUELWsWsn8Dm:PU6dsM8W4OGetLWsW
- TLSH T1D5B64B47EDA541E4C0AED535C6669623BA713C984F3063D36F90FB282F76BD0AAB5700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables referencing many IR and analysis tools
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
Detects executables referencing virtualization MAC addresses
-
UPX dump on OEP (original entry point)