Extracted

• • Target
    2026-07-02_6fafe578445c23f9f32231dd04df295e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 12.1MB
  • SHA256 1ae049e5908dab73a43ff7ed6912d7d3c04192e200fba9e1136f43b92bd9e141
  • MD5 6fafe578445c23f9f32231dd04df295e
  • SHA1 743e5da4c0eea5e7ee5c051bf1f783265bdffee4
  • SHA512 ff6795c81bd345053e3d4f51d171fe50c82b6c855a53e84380e3151070446ed7b65e7eea7bd2ff755c20743214b47438d893cef029f4f57d638e17b5b8249bb3
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hREhRNhRdhR3hRRhRXhRq:DAkLRLRxRYRfRvRxRbRRRq
  • TLSH
    T13FD6B032F6E445AAC2BFE274C06206217EB1B8675326FB8B5F8055ED1D63BD0AD19313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  persistenceadwarespyware

  • Detects executables referencing virtualization MAC addresses

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2