General
- Target 2026-10-25_b915ed771894b812a8096c2430d78907_coinminer_dosia_poet-rat_quasar-rat_snatch
- Size 38.1MB
- Sample261026-r2e4aatt5p
- SHA256 c9e93dd88d95399dd795aebf22e6fc2b5b327dba3c5ac2da9201d977183cd037
- MD5 b915ed771894b812a8096c2430d78907
- SHA1 bcaf6dfe661773b5aa9bd29620e5c76cbf82cf32
- SHA512 218a1649d1185a165eb169cbeb5cd72c3309b2f93d4f0f502f5d425255a8188de0896ef2e945ea708185e33bc1fb3f9664a92a152f60be58145fb1182aff9c0b
- SSDEEP 393216:UTz36gjZPxxV4cjF0V0yuU9x6zcfon3vi/iRuAWzu+t1JQWjqcYm2HeLAGwZcphe:UTzhjZJxjqDuUmUon6c7Yu+t1t3BQ
- TLSH T1B3973A83F891118DC9EAC378A021456BAE313C560B6C23C36551FF743F7ABE8A979749
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-25_b915ed771894b812a8096c2430d78907_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-25_b915ed771894b812a8096c2430d78907_coinminer_dosia_poet-rat_quasar-rat_snatch
- Size 38.1MB
- SHA256 c9e93dd88d95399dd795aebf22e6fc2b5b327dba3c5ac2da9201d977183cd037
- MD5 b915ed771894b812a8096c2430d78907
- SHA1 bcaf6dfe661773b5aa9bd29620e5c76cbf82cf32
- SHA512 218a1649d1185a165eb169cbeb5cd72c3309b2f93d4f0f502f5d425255a8188de0896ef2e945ea708185e33bc1fb3f9664a92a152f60be58145fb1182aff9c0b
- SSDEEP 393216:UTz36gjZPxxV4cjF0V0yuU9x6zcfon3vi/iRuAWzu+t1JQWjqcYm2HeLAGwZcphe:UTzhjZJxjqDuUmUon6c7Yu+t1t3BQ
- TLSH T1B3973A83F891118DC9EAC378A021456BAE313C560B6C23C36551FF743F7ABE8A979749
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Executes dropped EXE
Adds Run key to start application
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1