2026-04-15_947ced15fbe352a5b6c667952d437075_cobalt-strike_coinminer_glassworm_poet-rat_snatch

General

Target
2026-04-15_947ced15fbe352a5b6c667952d437075_cobalt-strike_coinminer_glassworm_poet-rat_snatch
Size 4.4MB
Sample260415-tx2slaf13x
SHA256 a210d1cca9927203172d01338bbaa54ab5b5ee3fb0c387f436b67ca49e9abd62
MD5 947ced15fbe352a5b6c667952d437075
SHA1 bcafb3e3071a704df9764efeaa29d25c566f4539
SHA512 deeee10bd0c8d2ca85def632201d2c9c37525333602ad395e2039a98905ae490079296c19dd0420a8dde743589394a23c9877dbd656b81f7210d7ac76dfa1ddc
SSDEEP 49152:NSrHAwUb4Dp4wiqPZzko0NRtq1SsFvKFi8HpgGPdP6VX8V48c0qTQW:NvWfKg78HIVX+EQW
TLSH
T105262A17F9D704EAD57EF2708296A732BA71349943713BD36F904A991A26FE07A3D300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-15_947ced15fbe352a5b6c667952d437075_cobalt-strike_coinminer_glassworm_poet-rat_snatch

2026-04-15_947ced15fbe352a5b6c667952d437075_cobalt-strike_coinminer_glassworm_poet-rat_snatch

.exe 4.4MB

SHA256 a210d1cca9927203172d01338bbaa54ab5b5ee3fb0c387f436b67ca49e9abd62
MD5 947ced15fbe352a5b6c667952d437075
SHA1 bcafb3e3071a704df9764efeaa29d25c566f4539
SHA512 deeee10bd0c8d2ca85def632201d2c9c37525333602ad395e2039a98905ae490079296c19dd0420a8dde743589394a23c9877dbd656b81f7210d7ac76dfa1ddc
SSDEEP 49152:NSrHAwUb4Dp4wiqPZzko0NRtq1SsFvKFi8HpgGPdP6VX8V48c0qTQW:NvWfKg78HIVX+EQW
TLSH
T105262A17F9D704EAD57EF2708296A732BA71349943713BD36F904A991A26FE07A3D300
MD5 SHA1 SHA512 SSDEEP TLSH

UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

360432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths