2026-08-24_b0d71807fc6ee21a660b801ce28a4c7d_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-08-24_b0d71807fc6ee21a660b801ce28a4c7d_coinminer_glassworm_poet-rat_sliver_snatch
Size 16.2MB
Sample260825-ejj83awfrf
SHA256 78f93dc3b0310060f1b3fa9da8c44ec7d7d14170c2b9bcbf675c2e62dbce7398
MD5 b0d71807fc6ee21a660b801ce28a4c7d
SHA1 8a43033bc6c54380c607fc391f5d1b6d9bfe2178
SHA512 3d4004a1eb701b8177c3921f943cd5f5bd8719b2c2eeaec1c41942676d6df33cfa543ebc05638a1a9705bb2ac8f8887fa9bb76211d30f76a558059489096f815
SSDEEP 393216:DAkLRCR3R7R6R/R9R6R6RVRPR7RYRURxRNRe:Ej
TLSH
T19E07CF32B7E849AAC2BFD375D06206222EF1B8275326FB8B5E8054FD1D53BD09915363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_b0d71807fc6ee21a660b801ce28a4c7d_coinminer_glassworm_poet-rat_sliver_snatch

2026-08-24_b0d71807fc6ee21a660b801ce28a4c7d_coinminer_glassworm_poet-rat_sliver_snatch

.exe 16.2MB

SHA256 78f93dc3b0310060f1b3fa9da8c44ec7d7d14170c2b9bcbf675c2e62dbce7398
MD5 b0d71807fc6ee21a660b801ce28a4c7d
SHA1 8a43033bc6c54380c607fc391f5d1b6d9bfe2178
SHA512 3d4004a1eb701b8177c3921f943cd5f5bd8719b2c2eeaec1c41942676d6df33cfa543ebc05638a1a9705bb2ac8f8887fa9bb76211d30f76a558059489096f815
SSDEEP 393216:DAkLRCR3R7R6R/R9R6R6RVRPR7RYRURxRNRe:Ej
TLSH
T19E07CF32B7E849AAC2BFD375D06206222EF1B8275326FB8B5E8054FD1D53BD09915363
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths