General
- Target 2026-07-10_93b32c9ee06f840c860aed33c3f8ee70_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260711-a7e7ssb14v
- SHA256 8bc60f0291d44e578fa44a6e91ec07a0be1ad881f46213bd4eda6a6c4e0e78f4
- MD5 93b32c9ee06f840c860aed33c3f8ee70
- SHA1 0d7ca3bddc575b981bc57caee5d82556171fe136
- SHA512 eb6d2568e564acba1b1e32057f52dfaef2fe34e6932d2361c7d2978020c0f3d17bde1dc710100f9f65df78ca334770f12d76150ea9de4887b6006ca255ab1aec
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUQ:5sPJYtJqwXmFto
- TLSH T15EF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_93b32c9ee06f840c860aed33c3f8ee70_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_93b32c9ee06f840c860aed33c3f8ee70_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-10_93b32c9ee06f840c860aed33c3f8ee70_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 8bc60f0291d44e578fa44a6e91ec07a0be1ad881f46213bd4eda6a6c4e0e78f4
- MD5 93b32c9ee06f840c860aed33c3f8ee70
- SHA1 0d7ca3bddc575b981bc57caee5d82556171fe136
- SHA512 eb6d2568e564acba1b1e32057f52dfaef2fe34e6932d2361c7d2978020c0f3d17bde1dc710100f9f65df78ca334770f12d76150ea9de4887b6006ca255ab1aec
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUQ:5sPJYtJqwXmFto
- TLSH T15EF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application