General
- Target 2026-08-10_8eaeb5449d993cbd5bfc91afa74dcec3_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260810-e2g7esvygs
- SHA256 9d72305f561aa859ddd735db13f9dd4b207c91477ee673d2b698d5854722d176
- MD5 8eaeb5449d993cbd5bfc91afa74dcec3
- SHA1 acd55445f4922da6789ab5c83792bd9e315774fd
- SHA512 3786ea38425854ac20daae201a7cc532fd0ca12470aa50acf88512be5018ad83ebb8f3abfedaf77f536c37b66dbc3cdcd9e757c15ddebcf016ec5dfb955903de
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUI:5sPJYtJqwXmFtA
- TLSH T1BAF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_8eaeb5449d993cbd5bfc91afa74dcec3_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_8eaeb5449d993cbd5bfc91afa74dcec3_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_8eaeb5449d993cbd5bfc91afa74dcec3_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 9d72305f561aa859ddd735db13f9dd4b207c91477ee673d2b698d5854722d176
- MD5 8eaeb5449d993cbd5bfc91afa74dcec3
- SHA1 acd55445f4922da6789ab5c83792bd9e315774fd
- SHA512 3786ea38425854ac20daae201a7cc532fd0ca12470aa50acf88512be5018ad83ebb8f3abfedaf77f536c37b66dbc3cdcd9e757c15ddebcf016ec5dfb955903de
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUI:5sPJYtJqwXmFtA
- TLSH T1BAF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application