General
- Target 2026-08-03_d1f8b065f919c2ead87006f661b7c3a2_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260804-ljnd2ssvht
- SHA256 68ac88db3288e168270a8e4069b4f0df6d6134afeb6f211fbf9db3b274f9bb1f
- MD5 d1f8b065f919c2ead87006f661b7c3a2
- SHA1 14c64d24b43e85996163960eca858ebed6a3d08e
- SHA512 31fe8a1fdac9497176a5585f1ab866a7345cf9abf3a9b365ca784e64ec282f2f808d1bd304bf1b22951d319cd6a6e2be24040c17ee3763b73a1ed33cde23f0bb
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUdh:5sPJYtJqwXmFtj
- TLSH T1A5F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_d1f8b065f919c2ead87006f661b7c3a2_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_d1f8b065f919c2ead87006f661b7c3a2_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_d1f8b065f919c2ead87006f661b7c3a2_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 68ac88db3288e168270a8e4069b4f0df6d6134afeb6f211fbf9db3b274f9bb1f
- MD5 d1f8b065f919c2ead87006f661b7c3a2
- SHA1 14c64d24b43e85996163960eca858ebed6a3d08e
- SHA512 31fe8a1fdac9497176a5585f1ab866a7345cf9abf3a9b365ca784e64ec282f2f808d1bd304bf1b22951d319cd6a6e2be24040c17ee3763b73a1ed33cde23f0bb
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUdh:5sPJYtJqwXmFtj
- TLSH T1A5F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application