General
- Target 2026-09-10_1866857e0f48ca1dae0eb4ff3dda7796_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 8.6MB
- Sample260910-yav4raveka
- SHA256 b523ef5f607861d3d5cd99134f934bf650f873cb3cafdbb054035089cf617cbc
- MD5 1866857e0f48ca1dae0eb4ff3dda7796
- SHA1 947da030ea5011c0046b6041d9a6d15ef995bc0e
- SHA512 3869a19bd2f5664c8359c4243cdac815d3582b219c6e1f2febb44b49d8b150642ccf54d73fadc1c8af6d01fac0f8440d5b5c1b2f3587f05b3672f91ed0da959f
- SSDEEP 98304:2ZYdsllDycgQgrsCF78fqAqBXiATTZETXASDchR9SDchRjSDchR7SDchRT:CwAlDycg3oBbqsATtThRBhRHhRfhRT
- TLSH T19996AE33FAE604EAC6BEE274C16253217E717C674331BB875F9045A91A62FD0AE2D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-10_1866857e0f48ca1dae0eb4ff3dda7796_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-10_1866857e0f48ca1dae0eb4ff3dda7796_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260710-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-10_1866857e0f48ca1dae0eb4ff3dda7796_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 8.6MB
- SHA256 b523ef5f607861d3d5cd99134f934bf650f873cb3cafdbb054035089cf617cbc
- MD5 1866857e0f48ca1dae0eb4ff3dda7796
- SHA1 947da030ea5011c0046b6041d9a6d15ef995bc0e
- SHA512 3869a19bd2f5664c8359c4243cdac815d3582b219c6e1f2febb44b49d8b150642ccf54d73fadc1c8af6d01fac0f8440d5b5c1b2f3587f05b3672f91ed0da959f
- SSDEEP 98304:2ZYdsllDycgQgrsCF78fqAqBXiATTZETXASDchR9SDchRjSDchR7SDchRT:CwAlDycg3oBbqsATtThRBhRHhRfhRT
- TLSH T19996AE33FAE604EAC6BEE274C16253217E717C674331BB875F9045A91A62FD0AE2D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables referencing virtualization MAC addresses
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory