2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch
Size 18.9MB
Sample260824-tmpehswwdv
SHA256 55064b6e03a37f043780f4fb8f540cb4b509cc3a9366152e8bf4441c89660edc
MD5 1ca3996b66de9d1e20c660579f3983a0
SHA1 584892eee9bf74648065d9ebcb74cae8174287d6
SHA512 33660fa15e952ca6f645c86a6141468451bc54232f3c8934c051d1923e50cb7b43928782c999c8b83d1efc145f1e526ddd79470ddb7eee5c5594690e89750ab4
SSDEEP 393216:v/HNRBR/RORXRURXR/ROR8R/RXROR/RXRHRyR/RXRuRk:3Z
TLSH
T14717CF32B7E84AAAC2FFD379D06206261FF1B4276227EB4F5D8444FA1D13B909915363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch

2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch

.exe 18.9MB

SHA256 55064b6e03a37f043780f4fb8f540cb4b509cc3a9366152e8bf4441c89660edc
MD5 1ca3996b66de9d1e20c660579f3983a0
SHA1 584892eee9bf74648065d9ebcb74cae8174287d6
SHA512 33660fa15e952ca6f645c86a6141468451bc54232f3c8934c051d1923e50cb7b43928782c999c8b83d1efc145f1e526ddd79470ddb7eee5c5594690e89750ab4
SSDEEP 393216:v/HNRBR/RORXRURXR/ROR8R/RXROR/RXRHRyR/RXRuRk:3Z
TLSH
T14717CF32B7E84AAAC2FFD379D06206261FF1B4276227EB4F5D8444FA1D13B909915363
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

362912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths