General
- Target 2026-07-14_5f9d53c26328e9b59fb96bb5814ada28_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260714-eeykwsdx6j
- SHA256 ad6e6b4500f29f84cc8987291b746299e10321a6499ebd746e57eee55a48be62
- MD5 5f9d53c26328e9b59fb96bb5814ada28
- SHA1 199c87afcd61c5678d29090eae60ea87fb092b95
- SHA512 33248a9cf764a2965ce4cd5b336d8221c1f8f9c0cc61cdba964cc561f2c4a8c3691d5982ce4a8758471d382c45b3f0cab0b79f749ff589636649b5edf3d84c13
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUD:5sPJYtJqwXmFtr
- TLSH T1F3F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_5f9d53c26328e9b59fb96bb5814ada28_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_5f9d53c26328e9b59fb96bb5814ada28_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_5f9d53c26328e9b59fb96bb5814ada28_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 ad6e6b4500f29f84cc8987291b746299e10321a6499ebd746e57eee55a48be62
- MD5 5f9d53c26328e9b59fb96bb5814ada28
- SHA1 199c87afcd61c5678d29090eae60ea87fb092b95
- SHA512 33248a9cf764a2965ce4cd5b336d8221c1f8f9c0cc61cdba964cc561f2c4a8c3691d5982ce4a8758471d382c45b3f0cab0b79f749ff589636649b5edf3d84c13
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUD:5sPJYtJqwXmFtr
- TLSH T1F3F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application