2026-10-22_abda13e97a3d15bf8c22bc62815e0c2a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_abda13e97a3d15bf8c22bc62815e0c2a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 10.0MB
Sample261024-bcp9yswt5m
SHA256 1d8f61d9c0af3a9107a2398c91259e8e3eec9060fd71e599007ad6294ff16ab7
MD5 abda13e97a3d15bf8c22bc62815e0c2a
SHA1 1995299e8a84ecfebd6bf4a92bc9b97a0adaa38a
SHA512 c474139f4d4713ca4ea32f7d32da0f69c5ac71d0dfa91faeab45637c2e9ef7e14c8afe9cb0a10e31099aedd31d91e9f683a47e94e166a7f520a7aebd693c91b9
SSDEEP 49152:V68YN1Q6OqF59Edfz+Y0l1WVQJ6MfZRXHvaGmHGkMC9Rgmo3u+537SIb8my6wNju:V6zT757CARl7yNuHu6hW/nVV/scEgsj
TLSH
T167B63817F8A514E9C1AED1348A769213BB717C494B2033D71B64BB283F76BD0AEB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_abda13e97a3d15bf8c22bc62815e0c2a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-10-22_abda13e97a3d15bf8c22bc62815e0c2a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 10.0MB

2026-10-22_abda13e97a3d15bf8c22bc62815e0c2a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH 673e9f4d8330ff310ff17ae5ab5624c8
SHA256 1d8f61d9c0af3a9107a2398c91259e8e3eec9060fd71e599007ad6294ff16ab7
MD5 abda13e97a3d15bf8c22bc62815e0c2a
SHA1 1995299e8a84ecfebd6bf4a92bc9b97a0adaa38a
SHA512 c474139f4d4713ca4ea32f7d32da0f69c5ac71d0dfa91faeab45637c2e9ef7e14c8afe9cb0a10e31099aedd31d91e9f683a47e94e166a7f520a7aebd693c91b9
SSDEEP 49152:V68YN1Q6OqF59Edfz+Y0l1WVQJ6MfZRXHvaGmHGkMC9Rgmo3u+537SIb8my6wNju:V6zT757CARl7yNuHu6hW/nVV/scEgsj
TLSH
T167B63817F8A514E9C1AED1348A769213BB717C494B2033D71B64BB283F76BD0AEB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Windows executables referencing non-Windows User-Agents
Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

589312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.8MB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

447KB

Virtual Size

32.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-10-22_abda13e97a3d15bf8c22bc62815e0c2a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic