General
- Target 2026-07-08_6509685b0ad26f10ab74209445b63cf4_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260708-c4e4qsaw3n
- SHA256 f7084f0560d9aa98ebeaa0e4d1cc53febf53b7599283d545f26991a2f52db682
- MD5 6509685b0ad26f10ab74209445b63cf4
- SHA1 d1a15fdaa59e036eb757d15aff70a50a86f83846
- SHA512 5587e18ad217aabcd6b7a204caf529866b067b06be7d0ac128d2468375db2ad2e98457f15eb2444f0bbe92a8bcc165cfd5248e434e6643b69731e908ae19b0c3
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUH:5sPJYtJqwXmFtP
- TLSH T1B8F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_6509685b0ad26f10ab74209445b63cf4_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_6509685b0ad26f10ab74209445b63cf4_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260706-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-08_6509685b0ad26f10ab74209445b63cf4_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 f7084f0560d9aa98ebeaa0e4d1cc53febf53b7599283d545f26991a2f52db682
- MD5 6509685b0ad26f10ab74209445b63cf4
- SHA1 d1a15fdaa59e036eb757d15aff70a50a86f83846
- SHA512 5587e18ad217aabcd6b7a204caf529866b067b06be7d0ac128d2468375db2ad2e98457f15eb2444f0bbe92a8bcc165cfd5248e434e6643b69731e908ae19b0c3
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUH:5sPJYtJqwXmFtP
- TLSH T1B8F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application