7fb27f88c282b344c533f57039edd078e4a80b4204a13071eae2f72a984af096

General

Target
2026-10-22_43c4e52a93b3dcfbea3802067c6df298_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 12.2MB
Sample261024-sd6rrsct5l
SHA256 7fb27f88c282b344c533f57039edd078e4a80b4204a13071eae2f72a984af096
MD5 43c4e52a93b3dcfbea3802067c6df298
SHA1 8efaa1eab8a2603e5eebb629b84cd765818de9a1
SHA512 bb591780c1fa3dd00fc080c12ce6e72a15309934469950f14aa9b3c55c8347be4d3dc3a07458c373ebb90433191aef3f8f3bb718275e080d8712e4760e7f9136
SSDEEP 98304:AMrKaHIy/PBcvOPVWDfCatGNed/pklYCKijYDh2F6X4pLN8ZZxE:xT5/p4dyZkIpaZS
TLSH
T1DAD63947ECA141E8C0AED170CA6A9127BFB13C495B3423D71A50F6342F76BD0ADBA794
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-10-22_43c4e52a93b3dcfbea3802067c6df298_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 12.2MB
- SHA256 7fb27f88c282b344c533f57039edd078e4a80b4204a13071eae2f72a984af096
- MD5 43c4e52a93b3dcfbea3802067c6df298
- SHA1 8efaa1eab8a2603e5eebb629b84cd765818de9a1
- SHA512 bb591780c1fa3dd00fc080c12ce6e72a15309934469950f14aa9b3c55c8347be4d3dc3a07458c373ebb90433191aef3f8f3bb718275e080d8712e4760e7f9136
- SSDEEP 98304:AMrKaHIy/PBcvOPVWDfCatGNed/pklYCKijYDh2F6X4pLN8ZZxE:xT5/p4dyZkIpaZS
- TLSH
  T1DAD63947ECA141E8C0AED170CA6A9127BFB13C495B3423D71A50F6342F76BD0ADBA794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access discovery execution persistence privilege_escalation spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1