2026-11-07_12c50e76bacff7e12ad7acfe09384ac2_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_12c50e76bacff7e12ad7acfe09384ac2_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat
Size 24.2MB
Sample261107-vb1tvaet8l
SHA256 89aaae045ea2490bdcf5e7d75e18579a758be54ed36fa418846b8bbd3da552e4
MD5 12c50e76bacff7e12ad7acfe09384ac2
SHA1 0c61a82feb3e81a98a411fb7dba8b6cf5297f972
SHA512 73c321456241dd5ebf88fce103274a1c111289cce26281574a8d6ca1bb5fe267b3978b13c8e48b0cbe67a95bf0784b26eab4361d8d9c89b697a34f2112072323
SSDEEP 196608:TZkdukAPLvijQ9/FODxyk1CLgmLkmp6TZ4vluZKW5fgYGxI:T2dNAPTD/FOZckmposOfg8
TLSH
T1C1477D47E82504E6C2B8C0F9895E564277B4BC081B25B7DB2B50F7287EB76D0BE7A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_12c50e76bacff7e12ad7acfe09384ac2_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat

File Explorer

2026-11-07_12c50e76bacff7e12ad7acfe09384ac2_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat

.exe 24.2MB

2026-11-07_12c50e76bacff7e12ad7acfe09384ac2_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat

IMPHASH 2a2c0a694cebd3a0fd8ae801a79d1c4b
SHA256 89aaae045ea2490bdcf5e7d75e18579a758be54ed36fa418846b8bbd3da552e4
MD5 12c50e76bacff7e12ad7acfe09384ac2
SHA1 0c61a82feb3e81a98a411fb7dba8b6cf5297f972
SHA512 73c321456241dd5ebf88fce103274a1c111289cce26281574a8d6ca1bb5fe267b3978b13c8e48b0cbe67a95bf0784b26eab4361d8d9c89b697a34f2112072323
SSDEEP 196608:TZkdukAPLvijQ9/FODxyk1CLgmLkmp6TZ4vluZKW5fgYGxI:T2dNAPTD/FOZckmposOfg8
TLSH
T1C1477D47E82504E6C2B8C0F9895E564277B4BC081B25B7DB2B50F7287EB76D0BE7A350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredContinueHandler AddVectoredExceptionHandler CloseHandle CreateEventA CreateFileA CreateFileW CreateIoCompletionPort CreateSemaphoreA CreateThread CreateWaitableTimerA CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetCurrentThreadId GetEnvironmentStringsW GetErrorMode GetFileInformationByHandle GetLastError GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryA GetSystemInfo GetThreadContext InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetErrorMode SetEvent SetProcessPriorityBoost SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread TlsAlloc TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WerGetFlags WerSetFlags WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler

mf

MFEnumDeviceSources

mfplat

MFCreateAttributes MFCreateMediaType MFShutdown MFStartup

mfreadwrite

MFCreateSourceReaderFromMediaSource

api-ms-win-crt-convert-l1-1-0

wcsrtombs

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr exp log pow sin sqrt

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _assert _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _wfopen fclose fopen fread fseek ftell fwrite

api-ms-win-crt-string-l1-1-0

_stricmp memset strlen strncmp strncpy

ole32

CoInitializeEx CoTaskMemFree CoUninitialize

Name

.text

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

435KB

Virtual Size

435KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

161KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

378KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

1024B

Virtual Size

795B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

691KB

Virtual Size

690KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

163B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

512B

Virtual Size

69B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/100

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/112

Size

512B

Virtual Size

504B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/128

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/144

Size

628KB

Virtual Size

628KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_12c50e76bacff7e12ad7acfe09384ac2_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat

kernel32

mf

mfplat

mfreadwrite

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

ole32

generic