General
- Target 2026-07-12_9b15041779819ad7367a3f9740c7d91e_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260713-bsdk4acz2x
- SHA256 40151ef65520b09b11b4dfed65d0613c72eb056d489d58f9a55daa1e8b11c8fd
- MD5 9b15041779819ad7367a3f9740c7d91e
- SHA1 2eae2a9973ce155f90f4368ed11501582b150e67
- SHA512 13cf5a8be425813aba041aa6a081ef8607dd4f6127cf1237a48dc5942d827c88f63cbed37cf16600a0ef67350789c4c95fb591f6bb657201df50675e1d1bab6b
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUZ:5sPJYtJqwXmFth
- TLSH T111F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_9b15041779819ad7367a3f9740c7d91e_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_9b15041779819ad7367a3f9740c7d91e_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-12_9b15041779819ad7367a3f9740c7d91e_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 40151ef65520b09b11b4dfed65d0613c72eb056d489d58f9a55daa1e8b11c8fd
- MD5 9b15041779819ad7367a3f9740c7d91e
- SHA1 2eae2a9973ce155f90f4368ed11501582b150e67
- SHA512 13cf5a8be425813aba041aa6a081ef8607dd4f6127cf1237a48dc5942d827c88f63cbed37cf16600a0ef67350789c4c95fb591f6bb657201df50675e1d1bab6b
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUZ:5sPJYtJqwXmFth
- TLSH T111F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application