2026-08-10_f94ef3c64770994f9f60c85130971bbe_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-08-10_f94ef3c64770994f9f60c85130971bbe_coinminer_glassworm_poet-rat_sliver_snatch
Size 16.5MB
Sample260810-lb1dmsfb84
SHA256 3cbb190b8b140ecb2884011d61512fec6808b2b59ff7fac85cce3cfdbe7cf603
MD5 f94ef3c64770994f9f60c85130971bbe
SHA1 97314db217ab543fd687c6ca0186b3e8c164c8a2
SHA512 056d9ee9ea8674a24f673fcb2bd53c17f0337f5a73d4c436aa589a55131dbad8e12a98a11eca4b43d255df3f96a8a4852865ba7a53f25c51ebbe68588de8301f
SSDEEP 393216:DAkLRCR3R7R6R/RnRIR+R1RgRhRiRsRKRfRx:E6
TLSH
T1B507C032B7E849AAC2BFD375D06206222EF1B8275326FB8B5E8055FD1D53BD09915323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_f94ef3c64770994f9f60c85130971bbe_coinminer_glassworm_poet-rat_sliver_snatch

2026-08-10_f94ef3c64770994f9f60c85130971bbe_coinminer_glassworm_poet-rat_sliver_snatch

.exe 16.5MB

SHA256 3cbb190b8b140ecb2884011d61512fec6808b2b59ff7fac85cce3cfdbe7cf603
MD5 f94ef3c64770994f9f60c85130971bbe
SHA1 97314db217ab543fd687c6ca0186b3e8c164c8a2
SHA512 056d9ee9ea8674a24f673fcb2bd53c17f0337f5a73d4c436aa589a55131dbad8e12a98a11eca4b43d255df3f96a8a4852865ba7a53f25c51ebbe68588de8301f
SSDEEP 393216:DAkLRCR3R7R6R/RnRIR+R1RgRhRiRsRKRfRx:E6
TLSH
T1B507C032B7E849AAC2BFD375D06206222EF1B8275326FB8B5E8055FD1D53BD09915323
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths