2da64165842306f1e5e9117bf6d1ac7a39073f9fdbe4d5179878ddc1264aef0d

General

Target
2026-09-12_45bbdd1f5f8155df60ee70e192b41298_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 6.7MB
Sample260913-c51f3azgmd
SHA256 2da64165842306f1e5e9117bf6d1ac7a39073f9fdbe4d5179878ddc1264aef0d
MD5 45bbdd1f5f8155df60ee70e192b41298
SHA1 b6d059f74c86e179c42017befe0b523997599d78
SHA512 c366c7b530720b8e339e33484160a9fb95fc6d0522d1db29c6b4bcb349c7c718f24a8d9505801bbf3f8949f478d751e3608bcdd6c4484c73179c9aa86ea569a3
SSDEEP 49152:y+AavOQa1bR6IQ6zq4jdBXQrMk44MN2Iuoa1hg676d02Vl4AibjScP5RpKKQK1Kc:y+N7Ohifo0OWaXELkoE0
TLSH
T1ED664907ECA515E9C1AED6358A77A5127F317C491B2223D72B90F6283F76BE0AD78310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-09-12_45bbdd1f5f8155df60ee70e192b41298_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.7MB
- SHA256 2da64165842306f1e5e9117bf6d1ac7a39073f9fdbe4d5179878ddc1264aef0d
- MD5 45bbdd1f5f8155df60ee70e192b41298
- SHA1 b6d059f74c86e179c42017befe0b523997599d78
- SHA512 c366c7b530720b8e339e33484160a9fb95fc6d0522d1db29c6b4bcb349c7c718f24a8d9505801bbf3f8949f478d751e3608bcdd6c4484c73179c9aa86ea569a3
- SSDEEP 49152:y+AavOQa1bR6IQ6zq4jdBXQrMk44MN2Iuoa1hg676d02Vl4AibjScP5RpKKQK1Kc:y+N7Ohifo0OWaXELkoE0
- TLSH
  T1ED664907ECA515E9C1AED6358A77A5127F317C491B2223D72B90F6283F76BE0AD78310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence privilege_escalation ransomware stealer
- Clears Windows event logs
  defense_evasion ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2