2026-09-09_2e1aea0cb67d64da90f038bfa62b1e2f_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-09-09_2e1aea0cb67d64da90f038bfa62b1e2f_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Size 9.4MB
Sample260909-2bv2xstthx
SHA256 73088db57d7017718174134257be55010260404306024ad207a3c9d04b210e4f
MD5 2e1aea0cb67d64da90f038bfa62b1e2f
SHA1 7ac448847176354c70633f1a40eb18a16c81da5d
SHA512 dae38b5d5dcc8a570538633dc0fc9eaeee7218b173af7304ad69e91e9d90ee95563ef7427fa546e60928c9b7d314b5ac7da0da5537c696b823991d688a44ad8b
SSDEEP 196608:mbDkZphgT73KxRyfCfShRphR7hRJhRMhRY:wABcRjRNRDRwRY
TLSH
T185A69E32FAE514EAC2BFE174C16257217EB2747B4331BB875F8049A91A12FD0AD2D352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-09_2e1aea0cb67d64da90f038bfa62b1e2f_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

2026-09-09_2e1aea0cb67d64da90f038bfa62b1e2f_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

.exe 9.4MB

SHA256 73088db57d7017718174134257be55010260404306024ad207a3c9d04b210e4f
MD5 2e1aea0cb67d64da90f038bfa62b1e2f
SHA1 7ac448847176354c70633f1a40eb18a16c81da5d
SHA512 dae38b5d5dcc8a570538633dc0fc9eaeee7218b173af7304ad69e91e9d90ee95563ef7427fa546e60928c9b7d314b5ac7da0da5537c696b823991d688a44ad8b
SSDEEP 196608:mbDkZphgT73KxRyfCfShRphR7hRJhRMhRY:wABcRjRNRDRwRY
TLSH
T185A69E32FAE514EAC2BFE174C16257217EB2747B4331BB875F8049A91A12FD0AD2D352
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths