2026-08-23_a9395e1226e105bb0083f27c1e6d7315_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-08-23_a9395e1226e105bb0083f27c1e6d7315_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Size 10.8MB
Sample260824-cmp8dack9w
SHA256 6f0725d30a35e0ca0832abf8c74757980ab954243853d3c0b7604f14fdd75937
MD5 a9395e1226e105bb0083f27c1e6d7315
SHA1 f8b55c1ad03d6a17bd64be00175eccf85de53e68
SHA512 f957abf3d68c48c27da6b1fe416d5a0177ef7d2956c92a9e40e85bf5e81ac5beb1d4ea425569b68dee7de68b30a9ffcf5b7af4a00038de9452374cb04c0cd3b5
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhR+hRuhR6hR+hRq:Ts/cRLRBRaRKRORaRq
TLSH
T1E8B6B032F6E505AEC2BEE274C06257217EB1B8574332BB8B5F8055B91D63BD0AD2D312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_a9395e1226e105bb0083f27c1e6d7315_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

2026-08-23_a9395e1226e105bb0083f27c1e6d7315_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

.exe 10.8MB

SHA256 6f0725d30a35e0ca0832abf8c74757980ab954243853d3c0b7604f14fdd75937
MD5 a9395e1226e105bb0083f27c1e6d7315
SHA1 f8b55c1ad03d6a17bd64be00175eccf85de53e68
SHA512 f957abf3d68c48c27da6b1fe416d5a0177ef7d2956c92a9e40e85bf5e81ac5beb1d4ea425569b68dee7de68b30a9ffcf5b7af4a00038de9452374cb04c0cd3b5
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhR+hRuhR6hR+hRq:Ts/cRLRBRaRKRORaRq
TLSH
T1E8B6B032F6E505AEC2BEE274C06257217EB1B8574332BB8B5F8055B91D63BD0AD2D312
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths