General
- Target 2026-06-30_65e2faac3ddc39a8fbfe3e94c53b4f08_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.2MB
- Sample260701-e8rz7sev2m
- SHA256 2a52ca68d59eb04b6e3d5d7483891d789bece63adbf119ac83da017ab42eecd1
- MD5 65e2faac3ddc39a8fbfe3e94c53b4f08
- SHA1 abf58751862bcec7e5cbb0ef12e89f5c25c6c3e5
- SHA512 bc5b07462e6dc4a033d3b489e3e2c0fb4bbaffd9c4dd081bb22bc5123a8fa175e15964647180eeabc43b59773c9922cdb73d971b3f4dc90d28af5dbf47179e66
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUL:5sPJYtJqwXmFtj
- TLSH T1EBF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_65e2faac3ddc39a8fbfe3e94c53b4f08_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_65e2faac3ddc39a8fbfe3e94c53b4f08_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260629-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-30_65e2faac3ddc39a8fbfe3e94c53b4f08_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.2MB
- SHA256 2a52ca68d59eb04b6e3d5d7483891d789bece63adbf119ac83da017ab42eecd1
- MD5 65e2faac3ddc39a8fbfe3e94c53b4f08
- SHA1 abf58751862bcec7e5cbb0ef12e89f5c25c6c3e5
- SHA512 bc5b07462e6dc4a033d3b489e3e2c0fb4bbaffd9c4dd081bb22bc5123a8fa175e15964647180eeabc43b59773c9922cdb73d971b3f4dc90d28af5dbf47179e66
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUL:5sPJYtJqwXmFtj
- TLSH T1EBF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application