6aba9e38e14f2e9b45167d55316148d0322c71271015810e4a433be8878debf3

General

Target
2026-08-23_fe564c4cc19ffb4f5d196a5e96a27f72_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 10.9MB
Sample260823-rg7b2asvas
SHA256 6aba9e38e14f2e9b45167d55316148d0322c71271015810e4a433be8878debf3
MD5 fe564c4cc19ffb4f5d196a5e96a27f72
SHA1 6b0e126c1ca7b367e3acfdbd0729cc3cbcf31867
SHA512 9ab39984e78e0a3f7d113e3fec60754947e7d8eabc2f8b05325ee3920eb3d73c0d584b51ca3bd613155b9d28ea9c6568f196970372cf688bfd5dee47ac8fee48
SSDEEP 49152:M42YfPwRJ7tVONJYvWDxPONXsUUrjWwCKOsCtLhXMehmOrupDKyM/GFP7ehLhe5r:M4hHoF9XopM8DryXKrTeblGmdREUE
TLSH
T10CB65A07EEA854E5C4ADD534CA769252BB71BC484B3223C31B60F6646F77BD0AEB9310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-23_fe564c4cc19ffb4f5d196a5e96a27f72_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 10.9MB
- SHA256 6aba9e38e14f2e9b45167d55316148d0322c71271015810e4a433be8878debf3
- MD5 fe564c4cc19ffb4f5d196a5e96a27f72
- SHA1 6b0e126c1ca7b367e3acfdbd0729cc3cbcf31867
- SHA512 9ab39984e78e0a3f7d113e3fec60754947e7d8eabc2f8b05325ee3920eb3d73c0d584b51ca3bd613155b9d28ea9c6568f196970372cf688bfd5dee47ac8fee48
- SSDEEP 49152:M42YfPwRJ7tVONJYvWDxPONXsUUrjWwCKOsCtLhXMehmOrupDKyM/GFP7ehLhe5r:M4hHoF9XopM8DryXKrTeblGmdREUE
- TLSH
  T10CB65A07EEA854E5C4ADD534CA769252BB71BC484B3223C31B60F6646F77BD0AEB9310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access discovery spyware stealer defense_evasion trojan
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2