General
- Target 2026-08-23_e1aef8bac7ce201c6659ffd78bfae0ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 9.5MB
- Sample260823-we3y2saj2s
- SHA256 3f28a874979be6437c68ec85b5bb7e8d60410858319abbb48015284d64cb620d
- MD5 e1aef8bac7ce201c6659ffd78bfae0ff
- SHA1 2d9172f8163f5cbae170cc0fb39d773492c87298
- SHA512 773e7555dcb328b777b17a02ee15265df2806f742e805062f9de44fbfd52958fbc833a2c0a9b46d0478a4e3e71eb9a21726e99a34bf1a9cd758aa9ff5f7a8cef
- SSDEEP 196608:mbDkZphgT73KxRyfCfShRphRfhRChR2hRG:wABcRjRpRmRiRG
- TLSH T158A69E32FAE514EAC2BFE174C16257217EB2747B4331BB875F8049A91A12FD0AD2D352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-23_e1aef8bac7ce201c6659ffd78bfae0ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_e1aef8bac7ce201c6659ffd78bfae0ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-23_e1aef8bac7ce201c6659ffd78bfae0ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 9.5MB
- SHA256 3f28a874979be6437c68ec85b5bb7e8d60410858319abbb48015284d64cb620d
- MD5 e1aef8bac7ce201c6659ffd78bfae0ff
- SHA1 2d9172f8163f5cbae170cc0fb39d773492c87298
- SHA512 773e7555dcb328b777b17a02ee15265df2806f742e805062f9de44fbfd52958fbc833a2c0a9b46d0478a4e3e71eb9a21726e99a34bf1a9cd758aa9ff5f7a8cef
- SSDEEP 196608:mbDkZphgT73KxRyfCfShRphRfhRChR2hRG:wABcRjRpRmRiRG
- TLSH T158A69E32FAE514EAC2BFE174C16257217EB2747B4331BB875F8049A91A12FD0AD2D352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables referencing virtualization MAC addresses
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory