General
- Target 2026-07-08_62500e48900c4b9a197a196e9b5b4c0e_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260708-e7nldsbw6q
- SHA256 4c41ed099ff6cc6f30714cd251a465fab5be6732572cc0ccb3b7961429281f7a
- MD5 62500e48900c4b9a197a196e9b5b4c0e
- SHA1 8a119b9d0039a3cf3ef098f0440edbc0ca7bf286
- SHA512 1c117f17fa874441fd5ab088f762a5a1201956403314a74c23c6fecd0664aae0abd634f176c7dfdf4c76d4cfb219b7f95a4c7dd56f163533586911f015e8b917
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUg:5sPJYtJqwXmFtI
- TLSH T1D5F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_62500e48900c4b9a197a196e9b5b4c0e_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_62500e48900c4b9a197a196e9b5b4c0e_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260706-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-08_62500e48900c4b9a197a196e9b5b4c0e_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 4c41ed099ff6cc6f30714cd251a465fab5be6732572cc0ccb3b7961429281f7a
- MD5 62500e48900c4b9a197a196e9b5b4c0e
- SHA1 8a119b9d0039a3cf3ef098f0440edbc0ca7bf286
- SHA512 1c117f17fa874441fd5ab088f762a5a1201956403314a74c23c6fecd0664aae0abd634f176c7dfdf4c76d4cfb219b7f95a4c7dd56f163533586911f015e8b917
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUg:5sPJYtJqwXmFtI
- TLSH T1D5F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application