General
- Target 2026-07-30_1b12312bd9bc89a92dad372ddbfd19a6_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260730-3pxckshd77
- SHA256 8bfcd687cbbcdddea8839593229948ddb00b99be00a0ac423329f84d2b132daf
- MD5 1b12312bd9bc89a92dad372ddbfd19a6
- SHA1 4d277685b8d296ea83213816eb3d5a586da9e1ab
- SHA512 3b80b5549b1781f02341acb35c8ce13256a038997ed7f5b52aee41542cd5e1e002aa0fc955cdc88b1b6941feb2469ee1ae9c270fcae9630fb515de1b6538c16e
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUg:5sPJYtJqwXmFtY
- TLSH T119F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_1b12312bd9bc89a92dad372ddbfd19a6_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_1b12312bd9bc89a92dad372ddbfd19a6_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-30_1b12312bd9bc89a92dad372ddbfd19a6_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 8bfcd687cbbcdddea8839593229948ddb00b99be00a0ac423329f84d2b132daf
- MD5 1b12312bd9bc89a92dad372ddbfd19a6
- SHA1 4d277685b8d296ea83213816eb3d5a586da9e1ab
- SHA512 3b80b5549b1781f02341acb35c8ce13256a038997ed7f5b52aee41542cd5e1e002aa0fc955cdc88b1b6941feb2469ee1ae9c270fcae9630fb515de1b6538c16e
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUg:5sPJYtJqwXmFtY
- TLSH T119F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application