General
- Target 2026-07-08_f8981b2319348ea3b1d34b3093559ce8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.2MB
- Sample260708-3nzfjsbt9v
- SHA256 7fa690dc25fd131742b433a1ddcfadb5e6f9c0fda818a52e26415fc2140f99ea
- MD5 f8981b2319348ea3b1d34b3093559ce8
- SHA1 e3570dfeae599a71747ace062da01d68882039fe
- SHA512 01b94bc0af8d9c3188c5bac7fad6e74c184c0b68e9d299bcc2a14700c97779f0d32e49a5fd0eeff5d11d04cb8bc5945c1055d97451b4439c4199fc060841830b
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUn:5sPJYtJqwXmFtf
- TLSH T12BF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_f8981b2319348ea3b1d34b3093559ce8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_f8981b2319348ea3b1d34b3093559ce8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260706-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-08_f8981b2319348ea3b1d34b3093559ce8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.2MB
- SHA256 7fa690dc25fd131742b433a1ddcfadb5e6f9c0fda818a52e26415fc2140f99ea
- MD5 f8981b2319348ea3b1d34b3093559ce8
- SHA1 e3570dfeae599a71747ace062da01d68882039fe
- SHA512 01b94bc0af8d9c3188c5bac7fad6e74c184c0b68e9d299bcc2a14700c97779f0d32e49a5fd0eeff5d11d04cb8bc5945c1055d97451b4439c4199fc060841830b
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUn:5sPJYtJqwXmFtf
- TLSH T12BF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application