0528a1b649f91cfd90de8ae17baae34eded382a4c385811ad552a7e21fa0b36f

General

Target
2026-10-30_c91095dec6076d93c2319a35e499ecae_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 10.9MB
Sample261030-vj3cmsdx2t
SHA256 0528a1b649f91cfd90de8ae17baae34eded382a4c385811ad552a7e21fa0b36f
MD5 c91095dec6076d93c2319a35e499ecae
SHA1 217388ccb133fbcb804ed107a0b09ae7e200a1d9
SHA512 eb205af002173eb12e5cb49e32f0b8c74861c59b8597ddd34e9574816e13f4fb546c0bf7ed180c626a0e3e5547c34f468c13f70c5311e5caeb7327e3f0705383
SSDEEP 98304:/I8admSAhyFtP20HTvU7aRMZVISZ1fDzbhTpT5UDEh:RzhuHnQ1f1T3UQ
TLSH
T162B65A4BEDA505E5C0AEC175CA6695A3BB703C884B3123D75B50FA246F33BD0AEB9710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-30_c91095dec6076d93c2319a35e499ecae_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 10.9MB
- SHA256 0528a1b649f91cfd90de8ae17baae34eded382a4c385811ad552a7e21fa0b36f
- MD5 c91095dec6076d93c2319a35e499ecae
- SHA1 217388ccb133fbcb804ed107a0b09ae7e200a1d9
- SHA512 eb205af002173eb12e5cb49e32f0b8c74861c59b8597ddd34e9574816e13f4fb546c0bf7ed180c626a0e3e5547c34f468c13f70c5311e5caeb7327e3f0705383
- SSDEEP 98304:/I8admSAhyFtP20HTvU7aRMZVISZ1fDzbhTpT5UDEh:RzhuHnQ1f1T3UQ
- TLSH
  T162B65A4BEDA505E5C0AEC175CA6695A3BB703C884B3123D75B50FA246F33BD0AEB9710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery spyware stealer trojan
- Detects executables referencing many IR and analysis tools
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Uses WMI to collect hardware manufacturer information
  Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral1