General
- Target 2026-07-10_b31d135edb5eeb050e45a31cf5ea09e1_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260710-c88a3sdt9z
- SHA256 b03fd6fd21fa38d90b5e413b68734b237945f7ee3ccc4ffa96dfcadaade0d857
- MD5 b31d135edb5eeb050e45a31cf5ea09e1
- SHA1 3455201787832330bc345c9829876e200169611a
- SHA512 757f1f5324b6c0e44a31781774478f9a1b02adc7fc51ea930caa1e367b99691055e0fda3aecc366a80347556567003803e8b0d7f6a8d59eae2f627bf178d4e1d
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUd+:5sPJYtJqwXmFtI
- TLSH T1AEF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_b31d135edb5eeb050e45a31cf5ea09e1_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_b31d135edb5eeb050e45a31cf5ea09e1_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-10_b31d135edb5eeb050e45a31cf5ea09e1_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 b03fd6fd21fa38d90b5e413b68734b237945f7ee3ccc4ffa96dfcadaade0d857
- MD5 b31d135edb5eeb050e45a31cf5ea09e1
- SHA1 3455201787832330bc345c9829876e200169611a
- SHA512 757f1f5324b6c0e44a31781774478f9a1b02adc7fc51ea930caa1e367b99691055e0fda3aecc366a80347556567003803e8b0d7f6a8d59eae2f627bf178d4e1d
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUd+:5sPJYtJqwXmFtI
- TLSH T1AEF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application