c335cc1ff5a5fecfda72732ffdc376fedf2fd1bd4222cacf42d20c7640443239

General

Target
2026-08-24_cb6cebd5a2c39a577027408c1e87999f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 10.9MB
Sample260825-bfk5eawana
SHA256 c335cc1ff5a5fecfda72732ffdc376fedf2fd1bd4222cacf42d20c7640443239
MD5 cb6cebd5a2c39a577027408c1e87999f
SHA1 ab30bf733c6e16757f90a749f9d1030bc7f2cda4
SHA512 d7ecad9733da73927d7e96a1d94dfbcf10268e4be67017cab3f1e6f51b4873d4a5ae8de1d834eadb070aee9bfdd9b6fb1be15b2945391c2e9f1242c8dd43b169
SSDEEP 98304:5XMBsVY6oZSL/4LXKrTe3l0WedIF68u8EUE:5cgYIL/Q3edX1t
TLSH
T15FB6490BEEA555E5C0EDD134CA769212BB71BC494B3263D72B90F6642F72BD06EB8310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-24_cb6cebd5a2c39a577027408c1e87999f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 10.9MB
- SHA256 c335cc1ff5a5fecfda72732ffdc376fedf2fd1bd4222cacf42d20c7640443239
- MD5 cb6cebd5a2c39a577027408c1e87999f
- SHA1 ab30bf733c6e16757f90a749f9d1030bc7f2cda4
- SHA512 d7ecad9733da73927d7e96a1d94dfbcf10268e4be67017cab3f1e6f51b4873d4a5ae8de1d834eadb070aee9bfdd9b6fb1be15b2945391c2e9f1242c8dd43b169
- SSDEEP 98304:5XMBsVY6oZSL/4LXKrTe3l0WedIF68u8EUE:5cgYIL/Q3edX1t
- TLSH
  T15FB6490BEEA555E5C0EDD134CA769212BB71BC494B3263D72B90F6642F72BD06EB8310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery spyware stealer trojan
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2