04dc769a35af0402b994eac65334bcc4d38c446d786f8286b08df2212d94b6e1 | Triage™

Login
Reports

Overview

overview

8

Static

static

3

2026-08-30...ch.exe

windows10-2004-x64

8

2026-08-30...ch.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-30_29619f9d1468b4bcbb50aa35bb306b66_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 7.5MB
Sample260830-yz3vwsgr3t
SHA256 04dc769a35af0402b994eac65334bcc4d38c446d786f8286b08df2212d94b6e1
MD5 29619f9d1468b4bcbb50aa35bb306b66
SHA1 aa4a656e1eed729d23186515a257a06c9969a8a7
SHA512 f4bd9cad7d89d3cc1b95c024a9fe0fd131233c14d0fff0f9fad2c3727cbec092552fb315818cc71e4282adea50f9121017b45bc34d053b0a7557e69bfb79ba75
SSDEEP 98304:MelonmKK2ZaiclEbrzGcumvBh8huTrKE9:Mzn3K2a2b2yX9
TLSH
T1EF865A07ECA555E8C1AEC23686729113BB717C490B3123D72BA0F6243F76BD06DBA758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2026-08-30_29619f9d1468b4bcbb50aa35bb306b66_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

13 signatures

150 seconds

defense_evasion execution persistence

Behavioral task

behavioral2

Sample

2026-08-30_29619f9d1468b4bcbb50aa35bb306b66_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Resource

win11ltsc2024-20260710-en

windows11-ltsc_2024-x64

14 signatures

150 seconds

defense_evasion execution persistence

Malware Config

Targets

- Target
  2026-08-30_29619f9d1468b4bcbb50aa35bb306b66_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 7.5MB
- SHA256 04dc769a35af0402b994eac65334bcc4d38c446d786f8286b08df2212d94b6e1
- MD5 29619f9d1468b4bcbb50aa35bb306b66
- SHA1 aa4a656e1eed729d23186515a257a06c9969a8a7
- SHA512 f4bd9cad7d89d3cc1b95c024a9fe0fd131233c14d0fff0f9fad2c3727cbec092552fb315818cc71e4282adea50f9121017b45bc34d053b0a7557e69bfb79ba75
- SSDEEP 98304:MelonmKK2ZaiclEbrzGcumvBh8huTrKE9:Mzn3K2a2b2yX9
- TLSH
  T1EF865A07ECA555E8C1AEC23686729113BB717C490B3123D72BA0F6243F76BD06DBA758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Create or Modify System Process

Windows Service

Scheduled Task/Job

Scheduled Task

Defense Evasion

Impair Defenses

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

defense_evasionexecutionpersistence

behavioral2

defense_evasionexecutionpersistence

© 2018-2026

Terms | Privacy