General
- Target 2026-08-10_c6f607f72679879b3d41f22d98d5b6bf_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260810-ek8m2sap2w
- SHA256 628b9de575f85ff4b12e763dc6d11e0149535495169ec29499774f8ff8326505
- MD5 c6f607f72679879b3d41f22d98d5b6bf
- SHA1 6626310caab66025bb7dedebb8e31d775512c124
- SHA512 3b8359bb9a549f0262dc7172747ac93a822a728bc744b117d00496434cf1cc84656e3696fdae6db1bc5565704500322a13e4265c636cabec2588ce0c23b17422
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUC6:5sPJYtJqwXmFtn
- TLSH T1B0F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_c6f607f72679879b3d41f22d98d5b6bf_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_c6f607f72679879b3d41f22d98d5b6bf_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_c6f607f72679879b3d41f22d98d5b6bf_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 628b9de575f85ff4b12e763dc6d11e0149535495169ec29499774f8ff8326505
- MD5 c6f607f72679879b3d41f22d98d5b6bf
- SHA1 6626310caab66025bb7dedebb8e31d775512c124
- SHA512 3b8359bb9a549f0262dc7172747ac93a822a728bc744b117d00496434cf1cc84656e3696fdae6db1bc5565704500322a13e4265c636cabec2588ce0c23b17422
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUC6:5sPJYtJqwXmFtn
- TLSH T1B0F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application