General
- Target 2026-07-29_87d4a0e27ad82997d9057a54111f303d_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260729-yywp7aec32
- SHA256 80c93948d26b0bafb2aba894635e2ba32d217d5389b305ddc6248b854dedeeef
- MD5 87d4a0e27ad82997d9057a54111f303d
- SHA1 3cd92abe6c3629c75f886e4422cdb5a792d011e9
- SHA512 7427dea661c0ded5aa55984fd5f4362be7ec2ae87fb4f4bc9dba5582c980100a3f226c9f7b244895e467ad55df91b93d88383ad2ec9226281f1608d25acce38f
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QU8q:5sPJYtJqwXmFtj
- TLSH T1AEF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_87d4a0e27ad82997d9057a54111f303d_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_87d4a0e27ad82997d9057a54111f303d_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-29_87d4a0e27ad82997d9057a54111f303d_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 80c93948d26b0bafb2aba894635e2ba32d217d5389b305ddc6248b854dedeeef
- MD5 87d4a0e27ad82997d9057a54111f303d
- SHA1 3cd92abe6c3629c75f886e4422cdb5a792d011e9
- SHA512 7427dea661c0ded5aa55984fd5f4362be7ec2ae87fb4f4bc9dba5582c980100a3f226c9f7b244895e467ad55df91b93d88383ad2ec9226281f1608d25acce38f
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QU8q:5sPJYtJqwXmFtj
- TLSH T1AEF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application