golsta_stealer | 2026-11-09_6c7dff99d3db229b9aced73148dddb28_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_6c7dff99d3db229b9aced73148dddb28_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 10.2MB
Sample261110-vbvylagh38
SHA256 9c1086abc73d059e23e97efe7cc53737a4154fd791d010d18a4d6b2ebaacf800
MD5 6c7dff99d3db229b9aced73148dddb28
SHA1 b9f7f83d83da29e68a68b12e29454b6b27ff7e63
SHA512 cbb81148937db1b41766a421e021325876c94ca2f44b61e3bb18dae08c801cb9c1629970cff2ce86791af3991e048d11fe559c00f3e87f226a63630376abf8e9
SSDEEP 98304:m6Y+kqhZDuRSFLt+7DN5XKrTeaGiCfQEsE:mOL/6R++t4CfpF
TLSH
T1D1B66A17EEA5A5E4C1ADC2718A779653BB71BC480B3163D31B50F2346E72BD06EBA310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer golsta_stealer

Malware Config

Signatures

Family: GolstaStealer
GolstaStealer is a Windows stealer written in Golang.
stealer golsta_stealer

Custom signature

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects GolstaStealer 1 IoCs

resource	yara_rule
sample	family_golsta_stealer

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_6c7dff99d3db229b9aced73148dddb28_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-11-09_6c7dff99d3db229b9aced73148dddb28_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 10.2MB

2026-11-09_6c7dff99d3db229b9aced73148dddb28_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 9c1086abc73d059e23e97efe7cc53737a4154fd791d010d18a4d6b2ebaacf800
MD5 6c7dff99d3db229b9aced73148dddb28
SHA1 b9f7f83d83da29e68a68b12e29454b6b27ff7e63
SHA512 cbb81148937db1b41766a421e021325876c94ca2f44b61e3bb18dae08c801cb9c1629970cff2ce86791af3991e048d11fe559c00f3e87f226a63630376abf8e9
SSDEEP 98304:m6Y+kqhZDuRSFLt+7DN5XKrTeaGiCfQEsE:mOL/6R++t4CfpF
TLSH
T1D1B66A17EEA5A5E4C1ADC2718A779653BB71BC480B3163D31B50F2346E72BD06EBA310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects GolstaStealer
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

555360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.3MB

Virtual Size

65.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

92KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

101KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-11-09_6c7dff99d3db229b9aced73148dddb28_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic