General
- Target 2026-07-27_80ebed07f63d91a17c22f79f4b395e38_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260728-ajvmkstfmc
- SHA256 6bc5d74224eb976f6385027d4585c7b35f4d74a070b58600d83a5c1fb20cbd42
- MD5 80ebed07f63d91a17c22f79f4b395e38
- SHA1 f94b80925a7ab87280ec25d980832e677785e570
- SHA512 e6f8d4a5eba07b211d6909115d7b390380d85c44f27e36481c589332b48bddc81fe53721c51debdad05c2cd1244e049e7e68e916f16ce6e3c840fc7e3666b919
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUm:5sPJYtJqwXmFtu
- TLSH T144F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_80ebed07f63d91a17c22f79f4b395e38_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_80ebed07f63d91a17c22f79f4b395e38_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-27_80ebed07f63d91a17c22f79f4b395e38_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 6bc5d74224eb976f6385027d4585c7b35f4d74a070b58600d83a5c1fb20cbd42
- MD5 80ebed07f63d91a17c22f79f4b395e38
- SHA1 f94b80925a7ab87280ec25d980832e677785e570
- SHA512 e6f8d4a5eba07b211d6909115d7b390380d85c44f27e36481c589332b48bddc81fe53721c51debdad05c2cd1244e049e7e68e916f16ce6e3c840fc7e3666b919
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUm:5sPJYtJqwXmFtu
- TLSH T144F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application