golsta_stealer | 2026-10-25_7fae4925b04567666e8da3dfae05bd9f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_7fae4925b04567666e8da3dfae05bd9f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 10.2MB
Sample261026-2ap5aahx7k
SHA256 d1958e5735249f2dbfa174e7c9b52861ebb17483a249185ed26744a2b7121ff0
MD5 7fae4925b04567666e8da3dfae05bd9f
SHA1 576090b93d1e550ffca99859e9b23fa0651ac691
SHA512 a40a1b1ad980a9ed4e2d6be56c7e00a523f3fc11254495a131bf7cc74647789230fe76368d577fd13da56565a11ae30ec7bb92444b53ed7222148b1fb920b963
SSDEEP 98304:m6Y+kqhZDuRSFLt+7DN5XKrTeaGiCf0EsE:mOL/6R++t4CfNF
TLSH
T121B66A17EEA5A5E4C1ADC2718A779653BB71BC480B3163D31B50F2346E72BD06EBA310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer golsta_stealer

Malware Config

Signatures

Family: GolstaStealer
GolstaStealer is a Windows stealer written in Golang.
stealer golsta_stealer

Custom signature

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects GolstaStealer 1 IoCs

resource	yara_rule
sample	family_golsta_stealer

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_7fae4925b04567666e8da3dfae05bd9f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-10-25_7fae4925b04567666e8da3dfae05bd9f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 10.2MB

2026-10-25_7fae4925b04567666e8da3dfae05bd9f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 d1958e5735249f2dbfa174e7c9b52861ebb17483a249185ed26744a2b7121ff0
MD5 7fae4925b04567666e8da3dfae05bd9f
SHA1 576090b93d1e550ffca99859e9b23fa0651ac691
SHA512 a40a1b1ad980a9ed4e2d6be56c7e00a523f3fc11254495a131bf7cc74647789230fe76368d577fd13da56565a11ae30ec7bb92444b53ed7222148b1fb920b963
SSDEEP 98304:m6Y+kqhZDuRSFLt+7DN5XKrTeaGiCf0EsE:mOL/6R++t4CfNF
TLSH
T121B66A17EEA5A5E4C1ADC2718A779653BB71BC480B3163D31B50F2346E72BD06EBA310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects GolstaStealer
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

555360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.3MB

Virtual Size

65.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

92KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

101KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-10-25_7fae4925b04567666e8da3dfae05bd9f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic