General
- Target 2026-08-22_c1907b7a8c45bb13ffc0ddb5a99ca2c7_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 8.7MB
- Sample260823-bevbpa1fng
- SHA256 4e2ea1a5b91bb87ec675eb1dc12b3022eb59393dec8b45c7def3a2a26135e173
- MD5 c1907b7a8c45bb13ffc0ddb5a99ca2c7
- SHA1 471f95e9ac5e769e1cb5bcc8e98c5894815a212a
- SHA512 616dd323d9485535c65b54ba3fd9845247895fdf4f670a24969485742cfdf45277742caea6b72096a34ee8809d4b1e1c343c263c17598d9522412983e36833a3
- SSDEEP 98304:LCbD4VZphgb/cc3oXlxRLT6fC93BnXASDchRlSDchR7SDchRASDchRG:mbDkZphgT73KxRyfCfShRphRfhRChRG
- TLSH T199968D32FAE514EAC2BEE170C16257217EB2747B43317B875F8059AA1A22FD0BD2D351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-22_c1907b7a8c45bb13ffc0ddb5a99ca2c7_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_c1907b7a8c45bb13ffc0ddb5a99ca2c7_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-22_c1907b7a8c45bb13ffc0ddb5a99ca2c7_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 8.7MB
- SHA256 4e2ea1a5b91bb87ec675eb1dc12b3022eb59393dec8b45c7def3a2a26135e173
- MD5 c1907b7a8c45bb13ffc0ddb5a99ca2c7
- SHA1 471f95e9ac5e769e1cb5bcc8e98c5894815a212a
- SHA512 616dd323d9485535c65b54ba3fd9845247895fdf4f670a24969485742cfdf45277742caea6b72096a34ee8809d4b1e1c343c263c17598d9522412983e36833a3
- SSDEEP 98304:LCbD4VZphgb/cc3oXlxRLT6fC93BnXASDchRlSDchR7SDchRASDchRG:mbDkZphgT73KxRyfCfShRphRfhRChRG
- TLSH T199968D32FAE514EAC2BEE170C16257217EB2747B43317B875F8059AA1A22FD0BD2D351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables referencing virtualization MAC addresses
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory