bd51d139c89c4edb87c063ad2bdde34e9e6a7c7f3f9c280e87e09d66fb1db721

General

Target
2026-10-28_69eac37468dd41059270ed1433f71fca_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 7.3MB
Sample261030-c832csh16n
SHA256 bd51d139c89c4edb87c063ad2bdde34e9e6a7c7f3f9c280e87e09d66fb1db721
MD5 69eac37468dd41059270ed1433f71fca
SHA1 16427ea6ce29adb65e2f6917edd2b337480f60d0
SHA512 3b601f9ff9dd70797831f7a630df895330f0d00f42e62685b54cf932e9e61b6a9fa8f36f39ca9ad25e95e9e6a1be9437e665add1590f44cf4e5fe793ded915ad
SSDEEP 49152:tD1iBu57lrNrz0Cmvxjvl6BWWzQ6iQ53yorM0ov/UEQp7WaC6q+aY5K6K5KwoJp:tU4zNmDeytctaaOOpZmxEG
TLSH
T15D764803FC6558E4C1AED2358A729112BB31BC495B2127E71B90F3386F72BE0ADB9754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-28_69eac37468dd41059270ed1433f71fca_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 7.3MB
- SHA256 bd51d139c89c4edb87c063ad2bdde34e9e6a7c7f3f9c280e87e09d66fb1db721
- MD5 69eac37468dd41059270ed1433f71fca
- SHA1 16427ea6ce29adb65e2f6917edd2b337480f60d0
- SHA512 3b601f9ff9dd70797831f7a630df895330f0d00f42e62685b54cf932e9e61b6a9fa8f36f39ca9ad25e95e9e6a1be9437e665add1590f44cf4e5fe793ded915ad
- SSDEEP 49152:tD1iBu57lrNrz0Cmvxjvl6BWWzQ6iQ53yorM0ov/UEQp7WaC6q+aY5K6K5KwoJp:tU4zNmDeytctaaOOpZmxEG
- TLSH
  T15D764803FC6558E4C1AED2358A729112BB31BC495B2127E71B90F3386F72BE0ADB9754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery evasion execution persistence ransomware spyware stealer
- Custom signature
  
  Detects executables embedding command execution via IExecuteCommand COM object
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (322) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1