6aa9f44f3d25dd48442a4852b9bc91a79f1b084e03722724087d3f9e14c4d8ef

General

Target
2026-10-23_76c247c37ec5d354cf1039b7e631ba2c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 10.2MB
Sample261023-mtfbvs1y2k
SHA256 6aa9f44f3d25dd48442a4852b9bc91a79f1b084e03722724087d3f9e14c4d8ef
MD5 76c247c37ec5d354cf1039b7e631ba2c
SHA1 be6ffc700f4f163816f3ea2cd5ea33638c244c3d
SHA512 c14aa5d496e0afdd57d601f9ea5305ef77bed006130c04b1c3fd854d3586f794fd45c9bf2c87a7a6c7c887bdd6ec98dd108f02ff16512ca70cc6e7d17cb0b1af
SSDEEP 98304:GdlKepxgDgYXNmVT1ENkhD9XKrTeqXfuEFE:kDx2kTeNkhGfL2
TLSH
T116B63847EDA564E4C1EDD1308AB29252BF71BC494B2223D71B90F6346E73BD09EBA350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-23_76c247c37ec5d354cf1039b7e631ba2c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 10.2MB
- SHA256 6aa9f44f3d25dd48442a4852b9bc91a79f1b084e03722724087d3f9e14c4d8ef
- MD5 76c247c37ec5d354cf1039b7e631ba2c
- SHA1 be6ffc700f4f163816f3ea2cd5ea33638c244c3d
- SHA512 c14aa5d496e0afdd57d601f9ea5305ef77bed006130c04b1c3fd854d3586f794fd45c9bf2c87a7a6c7c887bdd6ec98dd108f02ff16512ca70cc6e7d17cb0b1af
- SSDEEP 98304:GdlKepxgDgYXNmVT1ENkhD9XKrTeqXfuEFE:kDx2kTeNkhGfL2
- TLSH
  T116B63847EDA564E4C1EDD1308AB29252BF71BC494B2223D71B90F6346E73BD09EBA350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery spyware stealer
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1