be421bcad01e78d5cb7f402148fe29cb1c23c4427e7739fdd6632820f7cb8171

General

Target
2026-08-23_5ab65cc72c021c6e330fea3202ea70cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 10.8MB
Sample260824-m8bbfssthy
SHA256 be421bcad01e78d5cb7f402148fe29cb1c23c4427e7739fdd6632820f7cb8171
MD5 5ab65cc72c021c6e330fea3202ea70cf
SHA1 577eca845a5847f40875c696a9dde3bd755f0baa
SHA512 77e90266868bae9610b11d745a04192185e84f0c69956455bd0a58259c0662104ee3785244d1646d9b4becca10f5eff1a9aa8300233c01ec050afbfaff420518
SSDEEP 98304:jxWEE01vuRA1S1C5sfYADXKrTeGh2f8Lo4EUEG:jth5SIsQA+uYEt
TLSH
T162B64917EDA454E5C5ADC638CAB69253BB71BC494B3263C31B50F6282F76BD06EB9300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-23_5ab65cc72c021c6e330fea3202ea70cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 10.8MB
- SHA256 be421bcad01e78d5cb7f402148fe29cb1c23c4427e7739fdd6632820f7cb8171
- MD5 5ab65cc72c021c6e330fea3202ea70cf
- SHA1 577eca845a5847f40875c696a9dde3bd755f0baa
- SHA512 77e90266868bae9610b11d745a04192185e84f0c69956455bd0a58259c0662104ee3785244d1646d9b4becca10f5eff1a9aa8300233c01ec050afbfaff420518
- SSDEEP 98304:jxWEE01vuRA1S1C5sfYADXKrTeGh2f8Lo4EUEG:jth5SIsQA+uYEt
- TLSH
  T162B64917EDA454E5C5ADC638CAB69253BB71BC494B3263C31B50F6282F76BD06EB9300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access discovery spyware stealer
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2