Extracted

• • Target
    2026-07-08_64b823b43a368c403eda4e68ead2a059_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 14.5MB
  • SHA256 a52248612f3677f7bb81b0e6fcd3646f6c2520e3ac5beadff4b56c4fff3cc515
  • MD5 64b823b43a368c403eda4e68ead2a059
  • SHA1 7eee319909f41eb88a7c3de12828f308195e6060
  • SHA512 9cf606c89ea7588bda7649953c92af09bb6ab186f8cd77f9f86fb762aaa9e3ebc495017292eb325673d12e966af55bf2170d45472c978813ce4c8d80bf42dd3e
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hRxhRehRBhRGhRIhRthRAhRghRGhRghRC:DAkLRCR3R7R6RLRyRUR/R8RcRyRcRC
  • TLSH
    T137E6C032B7E449AAC2BFD275C06206222EF1B8675326FB8B5F8055FD1D53BD09919323
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  persistenceadwarespyware

  • Detects executables referencing virtualization MAC addresses

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2