General
- Target 2026-07-09_d30d6d117ae9795f45af90edbb3c2fec_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260710-acfvvaaz5r
- SHA256 a7f37033d532998be4273af0167fe908b825e2a3cf631553f0ed9c511fe30635
- MD5 d30d6d117ae9795f45af90edbb3c2fec
- SHA1 0972600ff504e2b11dac4438a9d33081c593c309
- SHA512 d62af3254664001ec4735c02a9d5005434919a9a5fa71f953c0b19ae5f9e022704f3a21457b9be3e62d0b6e4575362081c38c316d6d0e893f9fabab95f88201e
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUi:5sPJYtJqwXmFta
- TLSH T1F9F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_d30d6d117ae9795f45af90edbb3c2fec_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_d30d6d117ae9795f45af90edbb3c2fec_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_d30d6d117ae9795f45af90edbb3c2fec_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 a7f37033d532998be4273af0167fe908b825e2a3cf631553f0ed9c511fe30635
- MD5 d30d6d117ae9795f45af90edbb3c2fec
- SHA1 0972600ff504e2b11dac4438a9d33081c593c309
- SHA512 d62af3254664001ec4735c02a9d5005434919a9a5fa71f953c0b19ae5f9e022704f3a21457b9be3e62d0b6e4575362081c38c316d6d0e893f9fabab95f88201e
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUi:5sPJYtJqwXmFta
- TLSH T1F9F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application