f644e9f664386857d47e74a2b6da30239f2f0e757b0a8934bb6a1bd45666ed57 | Triage™

Login
Reports

Overview

overview

7

Static

static

1

2026-08-24...oe.exe

windows10-2004-x64

7

2026-08-24...oe.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-24_ce7b2544b4a0bd6fcd16d226758cf24c_coinminer_elex_frostygoop_ghostlocker_glassworm_hive_poet-rat_salatstealer_sliver_snatch
Size 35.6MB
Sample260825-a3wc8a1vgz
SHA256 f644e9f664386857d47e74a2b6da30239f2f0e757b0a8934bb6a1bd45666ed57
MD5 ce7b2544b4a0bd6fcd16d226758cf24c
SHA1 67bf0228c0fed4e8feecb19c010642fcb228f18c
SHA512 30354746099ec9c62abdc0054cab1ac0b0011a1b2eebb1475b9ff2835573444c259a93d436175f8a207ff8fe4f7fb0cad5ddb7ec2797d65902b2e57f20e4b12a
SSDEEP 393216:EHpSKRD66oYxAE7ApUs74AoiXGkHKAzDsghTEBcBD:EHlxbTxl7ApR74AZHbsGfl
TLSH
T10C876C90E89B13F5EE03483084AF626F27346A04DB15DECBD614BE76F8379D3067A196
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware trojan

Static task

static1

Behavioral task

behavioral1

Sample

2026-08-24_ce7b2544b4a0bd6fcd16d226758cf24c_coinminer_elex_frostygoop_ghostlocker_glassworm_hive_poe.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

12 signatures

150 seconds

defense_evasion discovery execution persistence privilege_escalation

Behavioral task

behavioral2

Sample

2026-08-24_ce7b2544b4a0bd6fcd16d226758cf24c_coinminer_elex_frostygoop_ghostlocker_glassworm_hive_poe.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

13 signatures

150 seconds

defense_evasion discovery execution persistence privilege_escalation spyware trojan

Malware Config

Targets

- Target
  2026-08-24_ce7b2544b4a0bd6fcd16d226758cf24c_coinminer_elex_frostygoop_ghostlocker_glassworm_hive_poet-rat_salatstealer_sliver_snatch
- Size 35.6MB
- SHA256 f644e9f664386857d47e74a2b6da30239f2f0e757b0a8934bb6a1bd45666ed57
- MD5 ce7b2544b4a0bd6fcd16d226758cf24c
- SHA1 67bf0228c0fed4e8feecb19c010642fcb228f18c
- SHA512 30354746099ec9c62abdc0054cab1ac0b0011a1b2eebb1475b9ff2835573444c259a93d436175f8a207ff8fe4f7fb0cad5ddb7ec2797d65902b2e57f20e4b12a
- SSDEEP 393216:EHpSKRD66oYxAE7ApUs74AoiXGkHKAzDsghTEBcBD:EHlxbTxl7ApR74AZHbsGfl
- TLSH
  T10C876C90E89B13F5EE03483084AF626F27346A04DB15DECBD614BE76F8379D3067A196
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware trojan
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

behavioral2

defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan

© 2018-2026

Terms | Privacy