68738d35a629f423ac46a149672164a29fbe3f104d15a3c8990412a2250ef612 | Triage™

Login
Reports

Overview

overview

8

Static

static

3

2026-09-29...ch.exe

windows10-2004-x64

8

2026-09-29...ch.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 6.2MB
Sample260929-we15fssyd1
SHA256 68738d35a629f423ac46a149672164a29fbe3f104d15a3c8990412a2250ef612
MD5 b8da660a9632a2e4b4877ddf11c64a73
SHA1 f374fedf598a988049d06bb0f79c83e9c6fead75
SHA512 8ddd9dacbfddd32c41ac444ad0e911cf988baf8c26ed7d5ea1d15562cd97da4dd5022b98f6722c46cf0789783244c99fab55afe3eb72fe3de0eb74958073357b
SSDEEP 49152:87vURVlRWHfsHFGNYh4NXY/PXjO6j6Wh+uHQMeYTQiYA04xBzEGOuJKQK1K6fElh:87cTlUL+eYmw6cDQNivO9EjGa
TLSH
T13B665A07FC9914E9C1AED57489679553BB71BC884B2123D71B90F6382F7ABE0ADB8340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

12 signatures

150 seconds

defense_evasion discovery execution persistence

Behavioral task

behavioral2

Sample

2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

12 signatures

150 seconds

defense_evasion discovery execution persistence

Malware Config

Targets

- Target
  2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 6.2MB
- SHA256 68738d35a629f423ac46a149672164a29fbe3f104d15a3c8990412a2250ef612
- MD5 b8da660a9632a2e4b4877ddf11c64a73
- SHA1 f374fedf598a988049d06bb0f79c83e9c6fead75
- SHA512 8ddd9dacbfddd32c41ac444ad0e911cf988baf8c26ed7d5ea1d15562cd97da4dd5022b98f6722c46cf0789783244c99fab55afe3eb72fe3de0eb74958073357b
- SSDEEP 49152:87vURVlRWHfsHFGNYh4NXY/PXjO6j6Wh+uHQMeYTQiYA04xBzEGOuJKQK1K6fElh:87cTlUL+eYmw6cDQNivO9EjGa
- TLSH
  T13B665A07FC9914E9C1AED57489679553BB71BC884B2123D71B90F6382F7ABE0ADB8340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

defense_evasiondiscoveryexecutionpersistence

behavioral2

defense_evasiondiscoveryexecutionpersistence

© 2018-2026

Terms | Privacy