General
- Target 2026-08-10_9575afde0bcea6ae524796290fae70e4_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- Sample260810-eyvcks1cqf
- SHA256 eaf9bdce0e7bedc55249fbfe44573545d212353818df5af34c71ac91c930dd59
- MD5 9575afde0bcea6ae524796290fae70e4
- SHA1 dfe6ba73f75630f023f9ec82889bc083d7108392
- SHA512 4a08b64ac89c6dde6c6395a6709e8082997ec456f73f43b28f82310c25da3f8d139c4bc59b6d43b9eaf7cc4dbb9ad72fb5c773ac97ea9dfe267ecfbcd39c5b36
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUd:5sPJYtJqwXmFtl
- TLSH T1DCF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_9575afde0bcea6ae524796290fae70e4_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_9575afde0bcea6ae524796290fae70e4_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_9575afde0bcea6ae524796290fae70e4_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch
- Size 15.3MB
- SHA256 eaf9bdce0e7bedc55249fbfe44573545d212353818df5af34c71ac91c930dd59
- MD5 9575afde0bcea6ae524796290fae70e4
- SHA1 dfe6ba73f75630f023f9ec82889bc083d7108392
- SHA512 4a08b64ac89c6dde6c6395a6709e8082997ec456f73f43b28f82310c25da3f8d139c4bc59b6d43b9eaf7cc4dbb9ad72fb5c773ac97ea9dfe267ecfbcd39c5b36
- SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUd:5sPJYtJqwXmFtl
- TLSH T1DCF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Adds Run key to start application