General
- Target 2026-07-19_ede7f1e83b8fc4851710f09e979fea2c_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260719-dh66rsds3x
- SHA256 9ba487a04401acc6660b48deaf16fc5daae02e09fd6fc4c2cd1a6068a6d658c5
- MD5 ede7f1e83b8fc4851710f09e979fea2c
- SHA1 e4d977ead00a1733efd67e09cc99866f06025aab
- SHA512 3e1a1c9f3295d71c00018f6e10e83b1000fc773efa25684fbd6f156eca663293cd71b69dc54b008f99a74f1c7f72be4cc7d8bf5f4f21b5d98e62fdfd81323bbb
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUS:5sPJYtJqwXmFt6
- TLSH T17BF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_ede7f1e83b8fc4851710f09e979fea2c_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_ede7f1e83b8fc4851710f09e979fea2c_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-19_ede7f1e83b8fc4851710f09e979fea2c_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 9ba487a04401acc6660b48deaf16fc5daae02e09fd6fc4c2cd1a6068a6d658c5
- MD5 ede7f1e83b8fc4851710f09e979fea2c
- SHA1 e4d977ead00a1733efd67e09cc99866f06025aab
- SHA512 3e1a1c9f3295d71c00018f6e10e83b1000fc773efa25684fbd6f156eca663293cd71b69dc54b008f99a74f1c7f72be4cc7d8bf5f4f21b5d98e62fdfd81323bbb
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUS:5sPJYtJqwXmFt6
- TLSH T17BF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application