General
- Target 2026-07-22_7c4168447c89be3ca79a62bb92779b4f_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260722-v6ej4aaa85
- SHA256 33fb5e8e89b9da60a182d90777eb9bb19e59b3640b5d812d3c23ad4d86921593
- MD5 7c4168447c89be3ca79a62bb92779b4f
- SHA1 d33b20c8a5e5e46f72286f954da12124eb593bca
- SHA512 db6b345e717f42b5bb7ba3d94b4f03bcd515cf4f34a912d66fc8f1b16f03b5ae19149232c42af48a5f8af392139d2e51a124c5437395190963107c237ae89b96
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUa:5sPJYtJqwXmFtS
- TLSH T19CF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_7c4168447c89be3ca79a62bb92779b4f_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_7c4168447c89be3ca79a62bb92779b4f_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-22_7c4168447c89be3ca79a62bb92779b4f_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 33fb5e8e89b9da60a182d90777eb9bb19e59b3640b5d812d3c23ad4d86921593
- MD5 7c4168447c89be3ca79a62bb92779b4f
- SHA1 d33b20c8a5e5e46f72286f954da12124eb593bca
- SHA512 db6b345e717f42b5bb7ba3d94b4f03bcd515cf4f34a912d66fc8f1b16f03b5ae19149232c42af48a5f8af392139d2e51a124c5437395190963107c237ae89b96
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUa:5sPJYtJqwXmFtS
- TLSH T19CF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application