General
- Target 2026-07-10_a5c7cb01543b0e6698c24d814e027aab_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260710-a1trlsbv6l
- SHA256 3a366b53465cd0d433ec69f9a3246c0335519397190e2d5237e042193bf59914
- MD5 a5c7cb01543b0e6698c24d814e027aab
- SHA1 dbf9860c55bf18f9b8bcab0f9b0ba85f016739c2
- SHA512 fa1bbea91730da1796f403f53323801b864aba88dfb2f8b9172fedd0937759d8022d5abe515f2a367d3dc4434e94cdb6e96ca4c5d72d061099cd08561c09d893
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUO:5sPJYtJqwXmFt2
- TLSH T17AF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_a5c7cb01543b0e6698c24d814e027aab_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_a5c7cb01543b0e6698c24d814e027aab_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-10_a5c7cb01543b0e6698c24d814e027aab_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 3a366b53465cd0d433ec69f9a3246c0335519397190e2d5237e042193bf59914
- MD5 a5c7cb01543b0e6698c24d814e027aab
- SHA1 dbf9860c55bf18f9b8bcab0f9b0ba85f016739c2
- SHA512 fa1bbea91730da1796f403f53323801b864aba88dfb2f8b9172fedd0937759d8022d5abe515f2a367d3dc4434e94cdb6e96ca4c5d72d061099cd08561c09d893
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUO:5sPJYtJqwXmFt2
- TLSH T17AF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application