General
- Target 2026-07-10_0c85c15d26067aa36229a907bd53b3a6_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260711-bcj3yah14k
- SHA256 c1ade615133d03cf0e688792dafb5ed4e1b6b3262ce82ad411e6954ceb2cd03f
- MD5 0c85c15d26067aa36229a907bd53b3a6
- SHA1 b6328195700fa83a54670e340b1b56094f75c703
- SHA512 0f021d0331ceabdb4720ca5de02cb890dbbc51e401635c612f97960423e89151fd61fe4b32bda674bf3bc5a887b351c102f47b00a540611d66f180f79a438e8b
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QU3:5sPJYtJqwXmFtf
- TLSH T14DF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_0c85c15d26067aa36229a907bd53b3a6_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_0c85c15d26067aa36229a907bd53b3a6_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-10_0c85c15d26067aa36229a907bd53b3a6_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 c1ade615133d03cf0e688792dafb5ed4e1b6b3262ce82ad411e6954ceb2cd03f
- MD5 0c85c15d26067aa36229a907bd53b3a6
- SHA1 b6328195700fa83a54670e340b1b56094f75c703
- SHA512 0f021d0331ceabdb4720ca5de02cb890dbbc51e401635c612f97960423e89151fd61fe4b32bda674bf3bc5a887b351c102f47b00a540611d66f180f79a438e8b
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QU3:5sPJYtJqwXmFtf
- TLSH T14DF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application