General
- Target 2026-08-01_f46db5dfc98260a9a9d64c2487b188d3_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260801-3d24pahn8z
- SHA256 72d231d704b9f5612db2dbda2213bf7e375c31c6f0ab1ede829cbea53307b6c1
- MD5 f46db5dfc98260a9a9d64c2487b188d3
- SHA1 27374afaa7f323da412a1a02482d1bfb28dec831
- SHA512 85cb3d14c73e36b212edc93a22f71307658612675ebe9c21fe05aab3cb8fc513ca9b625fe927c9572ca48c2e89cb1c20990faaf78411c23a28df7073040a21ba
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUT:5sPJYtJqwXmFtL
- TLSH T1ECF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_f46db5dfc98260a9a9d64c2487b188d3_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_f46db5dfc98260a9a9d64c2487b188d3_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_f46db5dfc98260a9a9d64c2487b188d3_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 72d231d704b9f5612db2dbda2213bf7e375c31c6f0ab1ede829cbea53307b6c1
- MD5 f46db5dfc98260a9a9d64c2487b188d3
- SHA1 27374afaa7f323da412a1a02482d1bfb28dec831
- SHA512 85cb3d14c73e36b212edc93a22f71307658612675ebe9c21fe05aab3cb8fc513ca9b625fe927c9572ca48c2e89cb1c20990faaf78411c23a28df7073040a21ba
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUT:5sPJYtJqwXmFtL
- TLSH T1ECF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application