General
- Target 2026-07-09_e80939ca4319ace3bf9f445fe2dccdb1_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260710-abl1gab19s
- SHA256 59351b047b486f965d20dfaf2305a9aca8e05b6382ba73b8f101e2b228b7882d
- MD5 e80939ca4319ace3bf9f445fe2dccdb1
- SHA1 2df77c997b8730210eb070fcc689c9d319f460ad
- SHA512 74126d3b2d49b0fb1b48e35b9bdb25d76e4caa5bdd95735e85767b651ec4d09f82484dea9647112f35bace23320e471bb605703e2bf3471250642773943b242a
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUdM:5sPJYtJqwXmFtG
- TLSH T152F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_e80939ca4319ace3bf9f445fe2dccdb1_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_e80939ca4319ace3bf9f445fe2dccdb1_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_e80939ca4319ace3bf9f445fe2dccdb1_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 59351b047b486f965d20dfaf2305a9aca8e05b6382ba73b8f101e2b228b7882d
- MD5 e80939ca4319ace3bf9f445fe2dccdb1
- SHA1 2df77c997b8730210eb070fcc689c9d319f460ad
- SHA512 74126d3b2d49b0fb1b48e35b9bdb25d76e4caa5bdd95735e85767b651ec4d09f82484dea9647112f35bace23320e471bb605703e2bf3471250642773943b242a
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUdM:5sPJYtJqwXmFtG
- TLSH T152F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application