General
- Target 2026-08-23_54702c12f03acd615f639bc7cffbeec6_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 9.5MB
- Sample260824-ntz7psdb95
- SHA256 b3d97d4463582494c16ca13cf6152f671a587dbb5dda72ce51619ed3a2cb8e40
- MD5 54702c12f03acd615f639bc7cffbeec6
- SHA1 32e1bce2abd02a2f23c28303a727a5f7586cdde1
- SHA512 885bde3c3a213ab70950d9dda7684a3a535e816a313904096a853cb3ad76049a5e0bbb0a95943f49581a5d88217f43cafcab3fbdc54d32cb9142308f9262989b
- SSDEEP 196608:mbDkZphgT73KxRyfCfShRphRfhRRhRLhRb:wABcRjRpRbRdRb
- TLSH T13EA69E32FAE514EAC2BFE174C16257217EB2747B4331BB875F8049A91A12FD0AD2D352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-23_54702c12f03acd615f639bc7cffbeec6_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_54702c12f03acd615f639bc7cffbeec6_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-23_54702c12f03acd615f639bc7cffbeec6_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 9.5MB
- SHA256 b3d97d4463582494c16ca13cf6152f671a587dbb5dda72ce51619ed3a2cb8e40
- MD5 54702c12f03acd615f639bc7cffbeec6
- SHA1 32e1bce2abd02a2f23c28303a727a5f7586cdde1
- SHA512 885bde3c3a213ab70950d9dda7684a3a535e816a313904096a853cb3ad76049a5e0bbb0a95943f49581a5d88217f43cafcab3fbdc54d32cb9142308f9262989b
- SSDEEP 196608:mbDkZphgT73KxRyfCfShRphRfhRRhRLhRb:wABcRjRpRbRdRb
- TLSH T13EA69E32FAE514EAC2BFE174C16257217EB2747B4331BB875F8049A91A12FD0AD2D352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables referencing virtualization MAC addresses
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory