General
- Target 2026-08-10_9bae95fe27d319ee7bda0a95d6d0f33c_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260810-ewgzga1cmf
- SHA256 15e0778793b5f9979730a7eb18a9edb34a55c9e5211338994633bdc25b62a31d
- MD5 9bae95fe27d319ee7bda0a95d6d0f33c
- SHA1 775b118625102498efeb8b763a99b9764f074e05
- SHA512 c5135d98da06000617b2ef158f53352bcde45402d45a8b436b8f125dda5dae51522023a7560740d824ffa064efbe57ba36f7e5513abe7f89da2def811fcca02f
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUT:5sPJYtJqwXmFtr
- TLSH T13FF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_9bae95fe27d319ee7bda0a95d6d0f33c_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_9bae95fe27d319ee7bda0a95d6d0f33c_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_9bae95fe27d319ee7bda0a95d6d0f33c_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 15e0778793b5f9979730a7eb18a9edb34a55c9e5211338994633bdc25b62a31d
- MD5 9bae95fe27d319ee7bda0a95d6d0f33c
- SHA1 775b118625102498efeb8b763a99b9764f074e05
- SHA512 c5135d98da06000617b2ef158f53352bcde45402d45a8b436b8f125dda5dae51522023a7560740d824ffa064efbe57ba36f7e5513abe7f89da2def811fcca02f
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUT:5sPJYtJqwXmFtr
- TLSH T13FF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application