General
- Target 2026-08-22_ab0a0927d913552f13b8e3d73a4ca844_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 10.9MB
- Sample260823-db677aw1by
- SHA256 85ba1c5edd6fc5fc7006344df71cd53f4ee3d681ad69ef4ce54730c42a89ccdc
- MD5 ab0a0927d913552f13b8e3d73a4ca844
- SHA1 dc3ced5923ee2aa2dca8c9bf09f8e293f44585a3
- SHA512 c5c0999a869406d3c2bf7b005345728f0776661268187b069bc471b66ba1d9aa49e9328175a07144bcef189ee9abe74a8902308642869e18f8dbef8ecd4834eb
- SSDEEP 196608:mbDkZphgT73KxRyfCfShRphRahRFhRfhRjhRAhRA:wABcRjRuRHRpRFR8RA
- TLSH T1C5C6AF32F6E514EAC2BFE274C16257217EB274774332BB8B5F8049A91913BD0AD2D352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-22_ab0a0927d913552f13b8e3d73a4ca844_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_ab0a0927d913552f13b8e3d73a4ca844_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-22_ab0a0927d913552f13b8e3d73a4ca844_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 10.9MB
- SHA256 85ba1c5edd6fc5fc7006344df71cd53f4ee3d681ad69ef4ce54730c42a89ccdc
- MD5 ab0a0927d913552f13b8e3d73a4ca844
- SHA1 dc3ced5923ee2aa2dca8c9bf09f8e293f44585a3
- SHA512 c5c0999a869406d3c2bf7b005345728f0776661268187b069bc471b66ba1d9aa49e9328175a07144bcef189ee9abe74a8902308642869e18f8dbef8ecd4834eb
- SSDEEP 196608:mbDkZphgT73KxRyfCfShRphRahRFhRfhRjhRAhRA:wABcRjRuRHRpRFR8RA
- TLSH T1C5C6AF32F6E514EAC2BFE274C16257217EB274774332BB8B5F8049A91913BD0AD2D352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables referencing virtualization MAC addresses
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory