a95f01065428db7c9172f16dcdcb6c007e1cc272c7ab6ed4e8a119465a6819a0

General

Target
2026-08-24_5ad78c22906555bfc58aa5fc7195474c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 10.8MB
Sample260825-pw2c8asdpd
SHA256 a95f01065428db7c9172f16dcdcb6c007e1cc272c7ab6ed4e8a119465a6819a0
MD5 5ad78c22906555bfc58aa5fc7195474c
SHA1 48245ba70d1e389475abd658a212176f0f2df4d8
SHA512 bd01196951e557cf1ebdbad763e3964f2c8147d75d7d7ec236a6d743272e48abb05b51ad7300f3bd44a1c857ae9c90aa08282e0d437ccac60891ed1cf563831a
SSDEEP 98304:RF2IBFbH7NGBTjQA6DBGXKrTea7g2p+aaEUE8f:R9LATjp6BBXte
TLSH
T13CB65A57EDA555E4C4ADD2348AB6D223BB71BC494B3123C71B90F6282F76BD06EB9300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-24_5ad78c22906555bfc58aa5fc7195474c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 10.8MB
- SHA256 a95f01065428db7c9172f16dcdcb6c007e1cc272c7ab6ed4e8a119465a6819a0
- MD5 5ad78c22906555bfc58aa5fc7195474c
- SHA1 48245ba70d1e389475abd658a212176f0f2df4d8
- SHA512 bd01196951e557cf1ebdbad763e3964f2c8147d75d7d7ec236a6d743272e48abb05b51ad7300f3bd44a1c857ae9c90aa08282e0d437ccac60891ed1cf563831a
- SSDEEP 98304:RF2IBFbH7NGBTjQA6DBGXKrTea7g2p+aaEUE8f:R9LATjp6BBXte
- TLSH
  T13CB65A57EDA555E4C4ADD2348AB6D223BB71BC494B3123C71B90F6282F76BD06EB9300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access discovery spyware stealer
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2