dff1e9df04ef47127c210c67f76da322fc69afee4c361e8518d6f4a125f19f04

General

Target
2026-10-28_9aa701fc7307d421f2e45b954cc71580_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 7.2MB
Sample261029-2szfnsty4n
SHA256 dff1e9df04ef47127c210c67f76da322fc69afee4c361e8518d6f4a125f19f04
MD5 9aa701fc7307d421f2e45b954cc71580
SHA1 f2a620862483372b22bfca623b53495bebd387f1
SHA512 92f62c95e7cad044b395a8a7b02559dba446d2ea9e9b971aed15993c5900ec9009b7f3794e6679cbd5982a725287b1ff611447ca028ba9df4f16331f1e95e5b6
SSDEEP 49152:w8XJZZTNesfvLcm6RNQQNudmODCm/fkh0IWnbTrLeY5BlSTT9+ajqK6K5KwdktD8:wQL18mceqoPHTSzmtmKKGZ6Eo
TLSH
T1C4764903EC5559E9C0AED23189769512BB71BC881B3123D71B90F2287F73BE0AEB9754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-10-28_9aa701fc7307d421f2e45b954cc71580_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 7.2MB
- SHA256 dff1e9df04ef47127c210c67f76da322fc69afee4c361e8518d6f4a125f19f04
- MD5 9aa701fc7307d421f2e45b954cc71580
- SHA1 f2a620862483372b22bfca623b53495bebd387f1
- SHA512 92f62c95e7cad044b395a8a7b02559dba446d2ea9e9b971aed15993c5900ec9009b7f3794e6679cbd5982a725287b1ff611447ca028ba9df4f16331f1e95e5b6
- SSDEEP 49152:w8XJZZTNesfvLcm6RNQQNudmODCm/fkh0IWnbTrLeY5BlSTT9+ajqK6K5KwdktD8:wQL18mceqoPHTSzmtmKKGZ6Eo
- TLSH
  T1C4764903EC5559E9C0AED23189769512BB71BC881B3123D71B90F2287F73BE0AEB9754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access discovery evasion execution persistence ransomware spyware stealer
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (2176) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1