General
- Target 2026-08-02_1bbfb3d6132342bff007772685ef991d_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260803-dy1c6abe56
- SHA256 7eb45e472b52d1b4b5dab7311d964ed0b7cb4e236a1bef0d14510b0ef44437fe
- MD5 1bbfb3d6132342bff007772685ef991d
- SHA1 8d05082eb7e0c3fe1a5f294f8e6bceae165df8cb
- SHA512 ce191291c8e7d9769be8b9dde04e77f58a3b0d9fad01865f9b3dc8ce3ee84fbabeb9be621553a43e10089cdf633825e5ceaeacb30cb59a51e982871afa8d5df3
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUC:5sPJYtJqwXmFtq
- TLSH T19DF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_1bbfb3d6132342bff007772685ef991d_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_1bbfb3d6132342bff007772685ef991d_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_1bbfb3d6132342bff007772685ef991d_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 7eb45e472b52d1b4b5dab7311d964ed0b7cb4e236a1bef0d14510b0ef44437fe
- MD5 1bbfb3d6132342bff007772685ef991d
- SHA1 8d05082eb7e0c3fe1a5f294f8e6bceae165df8cb
- SHA512 ce191291c8e7d9769be8b9dde04e77f58a3b0d9fad01865f9b3dc8ce3ee84fbabeb9be621553a43e10089cdf633825e5ceaeacb30cb59a51e982871afa8d5df3
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUC:5sPJYtJqwXmFtq
- TLSH T19DF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application