5133bb63e370a73d5cf7512daa3fabd6f6654171d1e3d99fcc50ebe51ab82209

General

Target
2026-10-22_8e3d018662ef5e92c8b5fc7c5cccccf1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 11.8MB
Sample261024-fr8gasec74
SHA256 5133bb63e370a73d5cf7512daa3fabd6f6654171d1e3d99fcc50ebe51ab82209
MD5 8e3d018662ef5e92c8b5fc7c5cccccf1
SHA1 28095b3c9d7d32bed63be96600ca63a2809f81e6
SHA512 08849087f67be5fb438a874947cc7d018814eb5c25dec0f665931d97baebf05e95506eba8258366df61763763e7d477ffccf1c43e69bc35ef59f7538b46feb1e
SSDEEP 98304:0qSQ/xIJbtNBHIJBJQKGvAo5IfVpErnD17PalE:0KpCIiwg687PaW
TLSH
T125C62947E8B505E8C0AED175C6269523BF713C895B3063D76B60FA242F36BE0ADB9704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-22_8e3d018662ef5e92c8b5fc7c5cccccf1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 11.8MB
- SHA256 5133bb63e370a73d5cf7512daa3fabd6f6654171d1e3d99fcc50ebe51ab82209
- MD5 8e3d018662ef5e92c8b5fc7c5cccccf1
- SHA1 28095b3c9d7d32bed63be96600ca63a2809f81e6
- SHA512 08849087f67be5fb438a874947cc7d018814eb5c25dec0f665931d97baebf05e95506eba8258366df61763763e7d477ffccf1c43e69bc35ef59f7538b46feb1e
- SSDEEP 98304:0qSQ/xIJbtNBHIJBJQKGvAo5IfVpErnD17PalE:0KpCIiwg687PaW
- TLSH
  T125C62947E8B505E8C0AED175C6269523BF713C895B3063D76B60FA242F36BE0ADB9704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- detects Windows exceutables potentially bypassing UAC (ab)using Environment Variables in Scheduled T
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Uses WMI to collect hardware manufacturer information
  Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2