General
- Target 2026-07-23_7e82b873fc1fdce2f96b525134d2f3bc_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260724-bkzhla1apd
- SHA256 f6e9e6252cfe71770be9909f36dcd638424d44840a69e9ba3cad0a33c93d9ab2
- MD5 7e82b873fc1fdce2f96b525134d2f3bc
- SHA1 37d79b3d38755e4f05d6bdbb8523a630687b6559
- SHA512 8a8885347aeb0afcf513a0e6cdff2ebde654dba8b398736836e1a6cdc5ca5a8419efd407832fa351be287b85600ebae5d1c60982cb9832e8912f872c57a6bdcd
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUb:5sPJYtJqwXmFtT
- TLSH T1CBF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_7e82b873fc1fdce2f96b525134d2f3bc_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_7e82b873fc1fdce2f96b525134d2f3bc_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_7e82b873fc1fdce2f96b525134d2f3bc_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 f6e9e6252cfe71770be9909f36dcd638424d44840a69e9ba3cad0a33c93d9ab2
- MD5 7e82b873fc1fdce2f96b525134d2f3bc
- SHA1 37d79b3d38755e4f05d6bdbb8523a630687b6559
- SHA512 8a8885347aeb0afcf513a0e6cdff2ebde654dba8b398736836e1a6cdc5ca5a8419efd407832fa351be287b85600ebae5d1c60982cb9832e8912f872c57a6bdcd
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUb:5sPJYtJqwXmFtT
- TLSH T1CBF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application