General
- Target 2026-07-08_bc51328b6578f82e0991bd96806d15ff_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260708-cray9aas9j
- SHA256 d9d53af344b113dbecd6402804cc0401ee02b3c1d4cc87dde5f9a0771457fdf2
- MD5 bc51328b6578f82e0991bd96806d15ff
- SHA1 effe66d7eca29718e8b80f5f781d61e525a2c09f
- SHA512 38475c38fa9f459a2a7d83c1bc51c05e2d25afaa8e2d0534ed74bde0f02c5af5628ba1f9d7cf33f4471c1ca9892513d29cba6c5a8237f84e04180f18e25afbfe
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUd:5sPJYtJqwXmFtV
- TLSH T1B1F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_bc51328b6578f82e0991bd96806d15ff_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_bc51328b6578f82e0991bd96806d15ff_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260706-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-08_bc51328b6578f82e0991bd96806d15ff_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 d9d53af344b113dbecd6402804cc0401ee02b3c1d4cc87dde5f9a0771457fdf2
- MD5 bc51328b6578f82e0991bd96806d15ff
- SHA1 effe66d7eca29718e8b80f5f781d61e525a2c09f
- SHA512 38475c38fa9f459a2a7d83c1bc51c05e2d25afaa8e2d0534ed74bde0f02c5af5628ba1f9d7cf33f4471c1ca9892513d29cba6c5a8237f84e04180f18e25afbfe
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUd:5sPJYtJqwXmFtV
- TLSH T1B1F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application