General
- Target 2026-08-10_d4ef810fb54e1b03a1159804ed9528d6_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260810-1j9plstyhy
- SHA256 e6a57a367479719a3855a653536833a7e1588de3561d27f660439be75d9a2fb3
- MD5 d4ef810fb54e1b03a1159804ed9528d6
- SHA1 af37290be3813609f4ca107d645bc855b1addb3c
- SHA512 08a79b1aa329acc7561b79e711171c03998e0124c627f081ae7bd6487db0723d3f7a1634b44614cc53295c81a5da6899c72451a6c53f8b42857fc2a4c568c0d6
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUu:5sPJYtJqwXmFt2
- TLSH T1EFF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_d4ef810fb54e1b03a1159804ed9528d6_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_d4ef810fb54e1b03a1159804ed9528d6_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_d4ef810fb54e1b03a1159804ed9528d6_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 e6a57a367479719a3855a653536833a7e1588de3561d27f660439be75d9a2fb3
- MD5 d4ef810fb54e1b03a1159804ed9528d6
- SHA1 af37290be3813609f4ca107d645bc855b1addb3c
- SHA512 08a79b1aa329acc7561b79e711171c03998e0124c627f081ae7bd6487db0723d3f7a1634b44614cc53295c81a5da6899c72451a6c53f8b42857fc2a4c568c0d6
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUu:5sPJYtJqwXmFt2
- TLSH T1EFF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application