2026-05-22_f6e5838daff4478d28ed725b40df66e4_cobalt-strike_coinminer_elex_glassworm_hive_poet-rat_snatch

General

Target
2026-05-22_f6e5838daff4478d28ed725b40df66e4_cobalt-strike_coinminer_elex_glassworm_hive_poet-rat_snatch
Size 5.2MB
Sample260522-e7nldsht2v
SHA256 2e8dd7c6154ad04c12bf7e84c277d9450b4357189e6689385875cb7bee49082d
MD5 f6e5838daff4478d28ed725b40df66e4
SHA1 d89df8c082a35369e03ac2703a88eabf43b57547
SHA512 27cfc86165ccf0bf519d4ccc44f004e4ba5906da5932a2dc299e15e3a8dddbfb086aca5dc3b0754a82f091b26bcb3b9d23ebcbfb258b3da2c88277ab68d11a54
SSDEEP 98304:hHEESxOcG8lerXKcmQRAw+6kncgiaT4J:tEEHME/t+6kncgiaT4
TLSH
T1E3462880F9DB40F5DA03153014A7A23F6734AD095B34DBCBEA50BF6AE877AE1093265D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Patched UPX-packed file 1 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
sample	patched_upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-22_f6e5838daff4478d28ed725b40df66e4_cobalt-strike_coinminer_elex_glassworm_hive_poet-rat_snatch

2026-05-22_f6e5838daff4478d28ed725b40df66e4_cobalt-strike_coinminer_elex_glassworm_hive_poet-rat_snatch

.exe 5.2MB

SHA256 2e8dd7c6154ad04c12bf7e84c277d9450b4357189e6689385875cb7bee49082d
MD5 f6e5838daff4478d28ed725b40df66e4
SHA1 d89df8c082a35369e03ac2703a88eabf43b57547
SHA512 27cfc86165ccf0bf519d4ccc44f004e4ba5906da5932a2dc299e15e3a8dddbfb086aca5dc3b0754a82f091b26bcb3b9d23ebcbfb258b3da2c88277ab68d11a54
SSDEEP 98304:hHEESxOcG8lerXKcmQRAw+6kncgiaT4J:tEEHME/t+6kncgiaT4
TLSH
T1E3462880F9DB40F5DA03153014A7A23F6734AD095B34DBCBEA50BF6AE877AE1093265D
MD5 SHA1 SHA512 SSDEEP TLSH

UPX dump on OEP (original entry point)
Patched UPX-packed file

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

411888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths