golsta_stealer | 2026-11-09_4c411123c58468bfe141bd5e3b44bb6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_4c411123c58468bfe141bd5e3b44bb6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 10.2MB
Sample261110-y2cfqaag69
SHA256 36166e38de5303fc841bc41a58d40c7a40a27262d21a2028b7d8a5197266806e
MD5 4c411123c58468bfe141bd5e3b44bb6d
SHA1 94a12db315770f63c7a7674998666ff0f29b09ba
SHA512 7ae48fee22a63a11f7c0425020537e96969fef7a076f7d4a3bad7d6fb95e4e79fc59a7ba4a2b9ef155de4401f65befe58827428f5cc64395fde01773f92ee29d
SSDEEP 98304:m6Y+kqhZDuRSFLt+7DN5XKrTeaGiCf6EsE:mOL/6R++t4CfnF
TLSH
T19EB66B17EEA5A5E4C1ADC2718A779653BB71BC480B3163D31B50F2346E72BD06EBA310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer golsta_stealer

Malware Config

Signatures

Family: GolstaStealer
GolstaStealer is a Windows stealer written in Golang.
stealer golsta_stealer

Custom signature

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects GolstaStealer 1 IoCs

resource	yara_rule
sample	family_golsta_stealer

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_4c411123c58468bfe141bd5e3b44bb6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-11-09_4c411123c58468bfe141bd5e3b44bb6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 10.2MB

2026-11-09_4c411123c58468bfe141bd5e3b44bb6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 36166e38de5303fc841bc41a58d40c7a40a27262d21a2028b7d8a5197266806e
MD5 4c411123c58468bfe141bd5e3b44bb6d
SHA1 94a12db315770f63c7a7674998666ff0f29b09ba
SHA512 7ae48fee22a63a11f7c0425020537e96969fef7a076f7d4a3bad7d6fb95e4e79fc59a7ba4a2b9ef155de4401f65befe58827428f5cc64395fde01773f92ee29d
SSDEEP 98304:m6Y+kqhZDuRSFLt+7DN5XKrTeaGiCf6EsE:mOL/6R++t4CfnF
TLSH
T19EB66B17EEA5A5E4C1ADC2718A779653BB71BC480B3163D31B50F2346E72BD06EBA310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects GolstaStealer
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

555360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.3MB

Virtual Size

65.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

92KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

101KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-11-09_4c411123c58468bfe141bd5e3b44bb6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic