General
- Target 2026-07-31_0d48c2137b616f209e2a86babf6cc15a_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260731-d33dbaam7v
- SHA256 a8f98b033e7e55bbbd5aa2aa6fb93bb19804cea40c6d60430c439fd8445b31c1
- MD5 0d48c2137b616f209e2a86babf6cc15a
- SHA1 3dd6d9488b16b9984e4973240435c87b2e38f85b
- SHA512 b3ed5e42adf158d52dde304a0610123c95c52dd06455fda131c9275dc0f9fa57e12ffb068f450a0aafa30d52c309c86167727af64d3abab5bfd498b59078a33e
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QU7H:5sPJYtJqwXmFtDH
- TLSH T12DF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_0d48c2137b616f209e2a86babf6cc15a_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_0d48c2137b616f209e2a86babf6cc15a_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_0d48c2137b616f209e2a86babf6cc15a_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 a8f98b033e7e55bbbd5aa2aa6fb93bb19804cea40c6d60430c439fd8445b31c1
- MD5 0d48c2137b616f209e2a86babf6cc15a
- SHA1 3dd6d9488b16b9984e4973240435c87b2e38f85b
- SHA512 b3ed5e42adf158d52dde304a0610123c95c52dd06455fda131c9275dc0f9fa57e12ffb068f450a0aafa30d52c309c86167727af64d3abab5bfd498b59078a33e
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QU7H:5sPJYtJqwXmFtDH
- TLSH T12DF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application