General
- Target 2026-07-10_0c614d44993443e1c20e9a32eff9cb03_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260710-cmkb5ab18k
- SHA256 9dc876725c3146a16be7d11b76780342b380d7a4bd338873f0420d3af51f3542
- MD5 0c614d44993443e1c20e9a32eff9cb03
- SHA1 6f0c9ecc49d70dd98d7fa57989188b4b87ab8dba
- SHA512 74c94a133879e72b9dd49f64d3eaa7e163a9f974ca68c93ba38ce1d4982190b47bdfaf3390ee913f3f4f5eacb31e393031f938d75830b97cc0718643b2dccac0
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUdu:5sPJYtJqwXmFtw
- TLSH T19AF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_0c614d44993443e1c20e9a32eff9cb03_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_0c614d44993443e1c20e9a32eff9cb03_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-10_0c614d44993443e1c20e9a32eff9cb03_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 9dc876725c3146a16be7d11b76780342b380d7a4bd338873f0420d3af51f3542
- MD5 0c614d44993443e1c20e9a32eff9cb03
- SHA1 6f0c9ecc49d70dd98d7fa57989188b4b87ab8dba
- SHA512 74c94a133879e72b9dd49f64d3eaa7e163a9f974ca68c93ba38ce1d4982190b47bdfaf3390ee913f3f4f5eacb31e393031f938d75830b97cc0718643b2dccac0
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUdu:5sPJYtJqwXmFtw
- TLSH T19AF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application