General
- Target 2026-08-10_5f5c25e545203ec098c3bd0be960050d_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260810-c1r9wstves
- SHA256 82b91e4b93adfa6051829e72e261f9ca559367efcf653d5e37ed0178b5059810
- MD5 5f5c25e545203ec098c3bd0be960050d
- SHA1 fbc55aafff7c8e769a5d40403eed70d58a6e8c93
- SHA512 8dd1fd1843719552eadcf37050f4f814bb46d68388854d31d43955c4cb85808ad0635cb573ec16a65e473d9b061059475a6644ceea9b26bb55cc8cb256f13d14
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUQ:5sPJYtJqwXmFto
- TLSH T140F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_5f5c25e545203ec098c3bd0be960050d_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_5f5c25e545203ec098c3bd0be960050d_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_5f5c25e545203ec098c3bd0be960050d_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 82b91e4b93adfa6051829e72e261f9ca559367efcf653d5e37ed0178b5059810
- MD5 5f5c25e545203ec098c3bd0be960050d
- SHA1 fbc55aafff7c8e769a5d40403eed70d58a6e8c93
- SHA512 8dd1fd1843719552eadcf37050f4f814bb46d68388854d31d43955c4cb85808ad0635cb573ec16a65e473d9b061059475a6644ceea9b26bb55cc8cb256f13d14
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUQ:5sPJYtJqwXmFto
- TLSH T140F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application