General
- Target 2026-07-19_088a7aeeceffec3052404a59227545a8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260719-3q6mmsgw7j
- SHA256 3af88ab33aa5fd65bce56fec64caa8ced4657b01219ef95874ed3c43870ae15f
- MD5 088a7aeeceffec3052404a59227545a8
- SHA1 8c3a49806dce86bc48ca6393f5ad3686e6cc3e0e
- SHA512 0c5d805d9c76978434097ecc99921e696d236fb1fda97c9154aa145bb93cae38cf1a867f27c6bd9b2263e10098342494d2a8a6f386d3db484aa42b57ddbadd1a
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUQ:5sPJYtJqwXmFtI
- TLSH T18FF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_088a7aeeceffec3052404a59227545a8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_088a7aeeceffec3052404a59227545a8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-19_088a7aeeceffec3052404a59227545a8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 3af88ab33aa5fd65bce56fec64caa8ced4657b01219ef95874ed3c43870ae15f
- MD5 088a7aeeceffec3052404a59227545a8
- SHA1 8c3a49806dce86bc48ca6393f5ad3686e6cc3e0e
- SHA512 0c5d805d9c76978434097ecc99921e696d236fb1fda97c9154aa145bb93cae38cf1a867f27c6bd9b2263e10098342494d2a8a6f386d3db484aa42b57ddbadd1a
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUQ:5sPJYtJqwXmFtI
- TLSH T18FF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application