2026-08-30_bbe75b546b449bc46f2c35b42deb614d_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-08-30_bbe75b546b449bc46f2c35b42deb614d_coinminer_glassworm_poet-rat_sliver_snatch
Size 19.1MB
Sample260831-gftdnswalg
SHA256 184b43e48502b7ca26d40f80d3798956b79ad7d09a10ff801b84df7f8fbac428
MD5 bbe75b546b449bc46f2c35b42deb614d
SHA1 721efa8335203735141216c2f39afe00e3bc1ffa
SHA512 7e3f704449a9e901211f73e283949ae00bfcfe84d28eef1f86d47f6c25873402d92e8f9cc482c6643b67b839bb9c4d034281a0b9eaf5a66e954cdaaead468786
SSDEEP 393216:DAkLRCR3R7R6RLRKRRRcRhRaRvRIRqRXRjRKRPR7RF:Em
TLSH
T10917C031B7E849AAC2BFD379D06206261EF0B827622BEB4F5E8054FD1D53BD09915363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-30_bbe75b546b449bc46f2c35b42deb614d_coinminer_glassworm_poet-rat_sliver_snatch

2026-08-30_bbe75b546b449bc46f2c35b42deb614d_coinminer_glassworm_poet-rat_sliver_snatch

.exe 19.1MB

SHA256 184b43e48502b7ca26d40f80d3798956b79ad7d09a10ff801b84df7f8fbac428
MD5 bbe75b546b449bc46f2c35b42deb614d
SHA1 721efa8335203735141216c2f39afe00e3bc1ffa
SHA512 7e3f704449a9e901211f73e283949ae00bfcfe84d28eef1f86d47f6c25873402d92e8f9cc482c6643b67b839bb9c4d034281a0b9eaf5a66e954cdaaead468786
SSDEEP 393216:DAkLRCR3R7R6RLRKRRRcRhRaRvRIRqRXRjRKRPR7RF:Em
TLSH
T10917C031B7E849AAC2BFD379D06206261EF0B827622BEB4F5E8054FD1D53BD09915363
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths