General
- Target 2026-07-20_5a90b14edd4d599ee7e0bee18609bbef_coinminer_dosia_elex_poet-rat_quasar-rat_sliver_snatch
- Size 23.5MB
- Sample260720-dmktbsgs2w
- SHA256 fb9406f8ca1726c8e23896d09f5b712290a5e53e98ccb23e26c3f648b27f6c2d
- MD5 5a90b14edd4d599ee7e0bee18609bbef
- SHA1 6d6554ba0d2e54239b9f3201ef9a10d26595ad17
- SHA512 eccec87d55315ba42dd2d028f428674008de4f1fdba598b705406b139531e87acd0e7e2a06168b844637a769f0699f0f01f7e400164b2cdbffca4d04e9847d32
- SSDEEP 393216:bs7aXpYtSjrMM2j7isIfmvbrBCDprYCf:47aPjrMM2j7inmvbrW
- TLSH T1EF474A15F9CB06F6E447883060A6622F23356E08C735C6A3E7D47B69F9F3761887724A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_5a90b14edd4d599ee7e0bee18609bbef_coinminer_dosia_elex_poet-rat_quasar-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_5a90b14edd4d599ee7e0bee18609bbef_coinminer_dosia_elex_poet-rat_quasar-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_5a90b14edd4d599ee7e0bee18609bbef_coinminer_dosia_elex_poet-rat_quasar-rat_sliver_snatch
- Size 23.5MB
- SHA256 fb9406f8ca1726c8e23896d09f5b712290a5e53e98ccb23e26c3f648b27f6c2d
- MD5 5a90b14edd4d599ee7e0bee18609bbef
- SHA1 6d6554ba0d2e54239b9f3201ef9a10d26595ad17
- SHA512 eccec87d55315ba42dd2d028f428674008de4f1fdba598b705406b139531e87acd0e7e2a06168b844637a769f0699f0f01f7e400164b2cdbffca4d04e9847d32
- SSDEEP 393216:bs7aXpYtSjrMM2j7isIfmvbrBCDprYCf:47aPjrMM2j7inmvbrW
- TLSH T1EF474A15F9CB06F6E447883060A6622F23356E08C735C6A3E7D47B69F9F3761887724A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.