General
- Target 2026-09-17_0446c8438c3ebfe34f3dd37ad921274d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 13.6MB
- Sample260917-23frbaea45
- SHA256 0abf73b31e07f20d5da04acff9e9e1c0b52dce5c2f691bd65fbd3cdee1584e4b
- MD5 0446c8438c3ebfe34f3dd37ad921274d
- SHA1 aeb3a5fb3dc72dd8fd92c33a40686ca7a34e6895
- SHA512 a8fcc24a31bdbc0a6aad4a97d2814d74ff1b9a840ba8f32ac3b05e5a97e3f05129ded1aea7fa9935189ba2c22a156c881c5306a6bb1b89d41abf215148c038d8
- SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRchR8:Ts/cRLRBR4R+RlR8R9RbRYRAR8
- TLSH T145E6BF22B7E449AEC2FFD274D06206217EB1B8675326EB8B5F8045F91D63BD0AD19313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-17_0446c8438c3ebfe34f3dd37ad921274d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260911-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-17_0446c8438c3ebfe34f3dd37ad921274d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260911-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-17_0446c8438c3ebfe34f3dd37ad921274d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 13.6MB
- SHA256 0abf73b31e07f20d5da04acff9e9e1c0b52dce5c2f691bd65fbd3cdee1584e4b
- MD5 0446c8438c3ebfe34f3dd37ad921274d
- SHA1 aeb3a5fb3dc72dd8fd92c33a40686ca7a34e6895
- SHA512 a8fcc24a31bdbc0a6aad4a97d2814d74ff1b9a840ba8f32ac3b05e5a97e3f05129ded1aea7fa9935189ba2c22a156c881c5306a6bb1b89d41abf215148c038d8
- SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRchR8:Ts/cRLRBR4R+RlR8R9RbRYRAR8
- TLSH T145E6BF22B7E449AEC2FFD274D06206217EB1B8675326EB8B5F8045F91D63BD0AD19313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables referencing virtualization MAC addresses
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory