General
- Target 2026-07-10_a8981369732f01b6f99cc32480ee17b8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260710-c9z14act3p
- SHA256 5990920949d335c4b8069009e8426c2a4c2222c7df059c0a1170309548428387
- MD5 a8981369732f01b6f99cc32480ee17b8
- SHA1 c2bd377ff8975e3529c0b9c0074c54a7268db777
- SHA512 0805cc96ae2fc4a32a606434a88b8ba0cdb65ab8d2a24a126425ae24cb3098830a057e30dcbc5787f266bcfae2833edb87b751c712fd3a369cb99f0643dbf2a7
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUw:5sPJYtJqwXmFt4
- TLSH T105F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_a8981369732f01b6f99cc32480ee17b8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_a8981369732f01b6f99cc32480ee17b8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-10_a8981369732f01b6f99cc32480ee17b8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 5990920949d335c4b8069009e8426c2a4c2222c7df059c0a1170309548428387
- MD5 a8981369732f01b6f99cc32480ee17b8
- SHA1 c2bd377ff8975e3529c0b9c0074c54a7268db777
- SHA512 0805cc96ae2fc4a32a606434a88b8ba0cdb65ab8d2a24a126425ae24cb3098830a057e30dcbc5787f266bcfae2833edb87b751c712fd3a369cb99f0643dbf2a7
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUw:5sPJYtJqwXmFt4
- TLSH T105F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application