General
- Target 2026-08-10_799e44581fd9c2f72c4b4e78be0645db_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260810-cv2alsdf38
- SHA256 7d95f9dc09ef2688764d0de6bacf5e36496780bdf4b6c74eacea577a2bea81e1
- MD5 799e44581fd9c2f72c4b4e78be0645db
- SHA1 3e3ead9fd5dfa1907ad54f46443e4d6224e4e904
- SHA512 d4929b7cc31390493d8451e51bb351d101033cd95144bb1d264907bc4ac0ef66b37cb7620bc358f12d44b035e02ae39b275c67a5883915d94281510923f08bad
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUA:5sPJYtJqwXmFtY
- TLSH T151F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_799e44581fd9c2f72c4b4e78be0645db_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_799e44581fd9c2f72c4b4e78be0645db_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_799e44581fd9c2f72c4b4e78be0645db_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 7d95f9dc09ef2688764d0de6bacf5e36496780bdf4b6c74eacea577a2bea81e1
- MD5 799e44581fd9c2f72c4b4e78be0645db
- SHA1 3e3ead9fd5dfa1907ad54f46443e4d6224e4e904
- SHA512 d4929b7cc31390493d8451e51bb351d101033cd95144bb1d264907bc4ac0ef66b37cb7620bc358f12d44b035e02ae39b275c67a5883915d94281510923f08bad
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUA:5sPJYtJqwXmFtY
- TLSH T151F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application