6f581f3d7ec6f27cf1289466efa59fcdc0370cb5dd66935afd3ad423c91c12b2

General

Target
2026-08-24_b490a08494b4ce54b4c2612840fda0b8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 11.0MB
Sample260825-d2b5qssvct
SHA256 6f581f3d7ec6f27cf1289466efa59fcdc0370cb5dd66935afd3ad423c91c12b2
MD5 b490a08494b4ce54b4c2612840fda0b8
SHA1 139aafe47fb0f08431fb8812901b62df50bff34b
SHA512 c0560ecc06de582e58b45d1c2a39e669e2f98cc7bf77e6952eceb8901c1aac38257926b866d480081c5947625c704904ae2d5d72fd6d94a6055b9f3867c393c2
SSDEEP 98304:/o9Fj45ALP5WbfMxlbkfXKrTe/h0AqvIcBEUE:/kUuLP5zlbm9qkt
TLSH
T1CEC65B17ED9954E5C4AED174CA769223BBB0BC494B3123D31B90F6282F72BD06EB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-24_b490a08494b4ce54b4c2612840fda0b8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 11.0MB
- SHA256 6f581f3d7ec6f27cf1289466efa59fcdc0370cb5dd66935afd3ad423c91c12b2
- MD5 b490a08494b4ce54b4c2612840fda0b8
- SHA1 139aafe47fb0f08431fb8812901b62df50bff34b
- SHA512 c0560ecc06de582e58b45d1c2a39e669e2f98cc7bf77e6952eceb8901c1aac38257926b866d480081c5947625c704904ae2d5d72fd6d94a6055b9f3867c393c2
- SSDEEP 98304:/o9Fj45ALP5WbfMxlbkfXKrTe/h0AqvIcBEUE:/kUuLP5zlbm9qkt
- TLSH
  T1CEC65B17ED9954E5C4AED174CA769223BBB0BC494B3123D31B90F6282F72BD06EB9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery spyware stealer trojan
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2