General
- Target 2026-07-09_e6003be191a3da47e5f37c91b0f7421a_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260709-b7efyabv4n
- SHA256 60ae2464856c216ab76bb7e11241891858403c51a5316d56f60c3f47dde03a51
- MD5 e6003be191a3da47e5f37c91b0f7421a
- SHA1 2639f12d3bbd35dd0dacecb56abcdb84403dac5b
- SHA512 8b3d42198d7ff886d7cd72de4bd819372c4b7cd878acf3377793b03c070dccbb83a92d40998add351ed8b7e768cbc1504d2d809038bbd6cbac4e301536703169
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUu:5sPJYtJqwXmFtm
- TLSH T1F5F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_e6003be191a3da47e5f37c91b0f7421a_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_e6003be191a3da47e5f37c91b0f7421a_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260706-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_e6003be191a3da47e5f37c91b0f7421a_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 60ae2464856c216ab76bb7e11241891858403c51a5316d56f60c3f47dde03a51
- MD5 e6003be191a3da47e5f37c91b0f7421a
- SHA1 2639f12d3bbd35dd0dacecb56abcdb84403dac5b
- SHA512 8b3d42198d7ff886d7cd72de4bd819372c4b7cd878acf3377793b03c070dccbb83a92d40998add351ed8b7e768cbc1504d2d809038bbd6cbac4e301536703169
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUu:5sPJYtJqwXmFtm
- TLSH T1F5F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application