Extracted

• • Target
    2026-09-30_4eaca16b132c15e32fc8b7ebfeaedaa6_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
  • Size 14.5MB
  • SHA256 cb942374b5cdc844e0c5cd9af766bfe08d72ecc038a7c382c005aae9fd7dd83a
  • MD5 4eaca16b132c15e32fc8b7ebfeaedaa6
  • SHA1 f2bbd564e931b806d60590bfda15d2f41889a3c0
  • SHA512 799fd654eb2dc1677e7b936062452699633d6c79833bf70acf77c5cf5af82d7ca93806996c567637c3f155b9e76fffe7369c23645a46fbb1fdb9feb00d5dd5de
  • SSDEEP 98304:6hMwZpbz7+GoEFWO2akpsYjVXsCY56s+ICekZJvfsrpcUEu:6LnD+55sCY563HeKkpct
  • TLSH
    T11EE63957F8A541E8C1AED535866291137FB13C894B3423E72B60F6286F37BD0AEB9710
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionwebratpersistenceratspywarestealertrojan

  • Family: WebRAT

    WebRAT is a Windows RAT written in Golang.

    ratwebrat

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables referencing many IR and analysis tools

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Detects executables referencing virtualization MAC addresses

  • detects Windows exceutables potentially bypassing UAC using fodhelper.exe

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2