General

  • Target
    2026-11-08_53821e9de9771292f40eb9bd292e7754_dcrat_glassworm_krakenkeylogger_poet-rat_quasar-rat
  • Size 29.3MB
  • Sample261109-d876rawxat
  • SHA256 07c4d59b4e514c2fd211c2607065bea3796cba08f49194da7a1c3f72422ceeea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Signatures

  • Custom signature
    Detects encrypted or obfuscated .NET executables 1 IoCs
  • Custom signature
    Detects executables manipulated with Fody 1 IoCs
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

File Explorer

  • 2026-11-08_53821e9de9771292f40eb9bd292e7754_dcrat_glassworm_krakenkeylogger_poet-rat_quasar-rat
    .exe 29.3MB

2026-11-08_53821e9de9771292f40eb9bd292e7754_dcrat_glassworm_krakenkeylogger_poet-rat_quasar-rat

  • IMPHASH 15e45789fcca31fa6d00850cd1a44d5a
  • SHA256 07c4d59b4e514c2fd211c2607065bea3796cba08f49194da7a1c3f72422ceeea
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Detects encrypted or obfuscated .NET executables

  • Detects executables manipulated with Fody

  • Codesign digest Mismatch

    File was altered after it was signed.

PE Signature issue

Digest
31:cc:d4:d3:54:1e:8b:dd:44:26:cd:d0:b7:11:5b:65:c6:fd:29:00:fd:29:af:5c:c6:cf:32:d8:8f:37:8f:41
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Overwolf Ltd,O=Overwolf Ltd,L=Ramat Gan,C=IL
Minor OS version
0
Major OS version
6
Entry point
30827224
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths