webrat | 2026-09-13_d5790b1c18f57cae6f5cc46b5d4b6010_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-13_d5790b1c18f57cae6f5cc46b5d4b6010_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch
Size 14.0MB
Sample260913-lte6esaa49
SHA256 92d1ebdc14b8aa7987e16d318dca40955491e8d0d0a88b48b0c469cd7f1c1140
MD5 d5790b1c18f57cae6f5cc46b5d4b6010
SHA1 f8224ab79d1ca8a91769c36c0baa7fe27ff8beae
SHA512 dda90638da5783d63c8183ec234e5de4af25b113a67d4c284050641e7174218929ef0cf4371c48b93b580ed25e01f57a22273736b3b2ba539bcc44a2926452cd
SSDEEP 98304:g7tCub5eHDngS+IzV0hN/oRFqKtTPW5zxCBaxEkoR+AhwYr92BP:CZygS+IzqQ5kFbSD+AVC
TLSH
T158E65B57F8A501E4C0AED535C666A263BB713C984B3423D76B50F7382F76BD0AAB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx rat webrat

Malware Config

Extracted

Family

webrat

Version

2.0.0

webratik.sbs:7777
https://webratik.sbs
https://arball.lat
https://webratik.eu.cc
https://webratik.lol
https://webratiko.eu.cc
https://salat.webratik.sbs
https://c2.webratik.sbs
https://ee.webratik.sbs
https://ge.webratik.sbs
https://78.17.187.5:59077
https://89.208.32.130:42781
https://89.125.120.6:62965
https://104.143.218.6:61870

Mutex

WEBR_KBFY6M96MCEW

Signatures

Family: WebRAT
WebRAT is a Windows RAT written in Golang.
rat webrat

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

detects Windows exceutables potentially bypassing UAC using fodhelper.exe 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_fodhelper

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-13_d5790b1c18f57cae6f5cc46b5d4b6010_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch

File Explorer

2026-09-13_d5790b1c18f57cae6f5cc46b5d4b6010_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch

.exe 14.0MB

2026-09-13_d5790b1c18f57cae6f5cc46b5d4b6010_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_snatch

SHA256 92d1ebdc14b8aa7987e16d318dca40955491e8d0d0a88b48b0c469cd7f1c1140
MD5 d5790b1c18f57cae6f5cc46b5d4b6010
SHA1 f8224ab79d1ca8a91769c36c0baa7fe27ff8beae
SHA512 dda90638da5783d63c8183ec234e5de4af25b113a67d4c284050641e7174218929ef0cf4371c48b93b580ed25e01f57a22273736b3b2ba539bcc44a2926452cd
SSDEEP 98304:g7tCub5eHDngS+IzV0hN/oRFqKtTPW5zxCBaxEkoR+AhwYr92BP:CZygS+IzqQ5kFbSD+AVC
TLSH
T158E65B57F8A501E4C0AED535C666A263BB713C984B3423D76B50F7382F76BD0AAB9700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables referencing many IR and analysis tools
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Detects executables referencing virtualization MAC addresses
UPX dump on OEP (original entry point)
detects Windows exceutables potentially bypassing UAC using fodhelper.exe
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

454720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths