6ac5337e2aaccccdb3e86714c61571884612253a170047454eacad8d81de679a

General

Target
2026-08-23_a61bd3a3429dc533e6429eb7f603195d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 10.8MB
Sample260824-c2964asdla
SHA256 6ac5337e2aaccccdb3e86714c61571884612253a170047454eacad8d81de679a
MD5 a61bd3a3429dc533e6429eb7f603195d
SHA1 55ae8ba8cfbcb3243a89995e4941803a5cd269cc
SHA512 548717f47b19553efd36c76cd5d0aed036e849a5b86c980158682dda4e5192a3b30afeefb198966dfd09deaf41360793cecf36ddaa085255a52a6b27e8ef1887
SSDEEP 98304:SymmxblfhPDvbLsc/zXKrTeN7wgUpYi4sCnCnq+IpEUE:ScZLDv19Spwqt
TLSH
T1F2B64B07EDA455E5C1ADC2748AB69222BB71BC484B3163D71B90F7282F76BD06EBD304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-23_a61bd3a3429dc533e6429eb7f603195d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 10.8MB
- SHA256 6ac5337e2aaccccdb3e86714c61571884612253a170047454eacad8d81de679a
- MD5 a61bd3a3429dc533e6429eb7f603195d
- SHA1 55ae8ba8cfbcb3243a89995e4941803a5cd269cc
- SHA512 548717f47b19553efd36c76cd5d0aed036e849a5b86c980158682dda4e5192a3b30afeefb198966dfd09deaf41360793cecf36ddaa085255a52a6b27e8ef1887
- SSDEEP 98304:SymmxblfhPDvbLsc/zXKrTeN7wgUpYi4sCnCnq+IpEUE:ScZLDv19Spwqt
- TLSH
  T1F2B64B07EDA455E5C1ADC2748AB69222BB71BC484B3163D71B90F7282F76BD06EBD304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access discovery spyware stealer
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2