db5af297bc1aa927554e4e7e07a0425500ce846a59637de4aa424c0c6daa1395

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 15:00

Target
2026-09-10_7ae70d905427836d96d86d957d71fce6_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe
Size 28.1MB
Sample260910-sdrmvatbma
SHA256 db5af297bc1aa927554e4e7e07a0425500ce846a59637de4aa424c0c6daa1395
MD5 7ae70d905427836d96d86d957d71fce6
SHA1 cb4d8958ae688ceb877ab04cc7a38c7c18e6fde6
SHA512 b8e0c35b41a864c74ca969fa9c794c067d7f6690c06cb634788dabe3c22b809adfddd3fc81f3e65cd41b21b828469b79196317046238d8aaeebe82fcdb55a6d8
SSDEEP 196608:Ewl5V6q+J5uwAVPw9C4NmUnAv/+3e5zmmvmux3bOSIML1I:Ew7V6lubPwY4A2An+ON7dx3Km1
TLSH
T1FC576A43FC6518E9C2EDD23189A652127B71BC491B3663DB1B60F6286F73BD0ADB9310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2220	cycops-agent.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-10_7ae70d905427836d96d86d957d71fce6_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_7ae70d905427836d96d86d957d71fce6_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe"
1⤵
PID:4932

C:\ProgramData\Cycops\accesscontrol\bin\cycops-agent.exe
C:\ProgramData\Cycops\accesscontrol\bin\cycops-agent.exe service
1⤵
- Executes dropped EXE
PID:2220

agent.json

Path C:\ProgramData\Cycops\accesscontrol\agent.json
Size 358B
SHA256 b87b92da7fb9c246940d16788bcfbf2014d65257e4a43afe658a08b850a69648
MD5 df673e36deb567f68df10f612893053d
SHA1 5d2fa8b5850cc6fec2bbf6ed053eb2cc0376080a
SHA512 fa365c58edd19cbc600e1193607edfc2bee11005d3458991e40606fe1c57eb42650a31f0b0b320fd3a7826b8c021c2e2498815be91a58642e9472f3fec002162
TLSH
T119E0204203AC42332CC8C78972C5C1440D7DDF16D202B82E576765D6915DF2711E38A4
MD5 SHA1 SHA512 TLSH

Submit Download

cycops-agent.exe

Path C:\ProgramData\Cycops\accesscontrol\bin\cycops-agent.exe
Size 28.1MB
SHA256 db5af297bc1aa927554e4e7e07a0425500ce846a59637de4aa424c0c6daa1395
MD5 7ae70d905427836d96d86d957d71fce6
SHA1 cb4d8958ae688ceb877ab04cc7a38c7c18e6fde6
SHA512 b8e0c35b41a864c74ca969fa9c794c067d7f6690c06cb634788dabe3c22b809adfddd3fc81f3e65cd41b21b828469b79196317046238d8aaeebe82fcdb55a6d8
SSDEEP 196608:Ewl5V6q+J5uwAVPw9C4NmUnAv/+3e5zmmvmux3bOSIML1I:Ew7V6lubPwY4A2An+ON7dx3Km1
TLSH
T1FC576A43FC6518E9C2EDD23189A652127B71BC491B3663DB1B60F6286F73BD0ADB9310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cycops-console.exe

Path C:\ProgramData\Cycops\accesscontrol\bin\cycops-console.exe
Size 7.6MB
SHA256 950a33c8def35faf77faa4b146921c3d9f60b2d2781dd7509227c1332ee22546
MD5 af032bb321b8177e37962b71457f8f67
SHA1 50a6f9e49b4bb1f0c13566333116b328e7d00d7c
SHA512 25ee4b5cd26a7cdf419f233afc1f85e602a026af2f399825f44b4f68494340b1b86fcd72e63662dd74b48a0598efd8e8fa0131ebecd3137eff7171812ebdb3a7
SSDEEP 49152:3k73tkTYddQJrKz699lJ+S6rK8Q8EmBVeArAtA02t3vejT5XHK54h39P8fI9KjN1:3kyUjS80i/u11VVJKsFg1TBEAv
TLSH
T17D864A07FDA569E8C1AEC23589769122BF317C491B2063D72B90F6282F77BD4AD79340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca-cert.pem

Path C:\ProgramData\Cycops\accesscontrol\ca-cert.pem
Size 526B
SHA256 e9caccd341f75bff0b8c67dee0e621cb7c038ff35bb0fba1fcd38d56dd26a62a
MD5 7583ad81fb623da1faf5dfe9cd96bb33
SHA1 bd5807bde5939303f545515164012ddf464547e0
SHA512 50f77fc2a07cf9ecbfd75f567ebd49d11e2032019a76fe2630aa244c37ffbda880b4f42cdc469d10dc992d940ef98f21bb3174ffcea1437a3e6faccac070d32c
TLSH
T196F005838D033D550FFBA0A1BCA44699635296E3124393BA3555E09AEF1D00FDEBF54C
MD5 SHA1 SHA512 TLSH

Submit Download