2026-09-17_0446c8438c3ebfe34f3dd37ad921274d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-09-17_0446c8438c3ebfe34f3dd37ad921274d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Size 13.6MB
Sample260917-23frbaea45
SHA256 0abf73b31e07f20d5da04acff9e9e1c0b52dce5c2f691bd65fbd3cdee1584e4b
MD5 0446c8438c3ebfe34f3dd37ad921274d
SHA1 aeb3a5fb3dc72dd8fd92c33a40686ca7a34e6895
SHA512 a8fcc24a31bdbc0a6aad4a97d2814d74ff1b9a840ba8f32ac3b05e5a97e3f05129ded1aea7fa9935189ba2c22a156c881c5306a6bb1b89d41abf215148c038d8
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRchR8:Ts/cRLRBR4R+RlR8R9RbRYRAR8
TLSH
T145E6BF22B7E449AEC2FFD274D06206217EB1B8675326EB8B5F8045F91D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-17_0446c8438c3ebfe34f3dd37ad921274d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

2026-09-17_0446c8438c3ebfe34f3dd37ad921274d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

.exe 13.6MB

SHA256 0abf73b31e07f20d5da04acff9e9e1c0b52dce5c2f691bd65fbd3cdee1584e4b
MD5 0446c8438c3ebfe34f3dd37ad921274d
SHA1 aeb3a5fb3dc72dd8fd92c33a40686ca7a34e6895
SHA512 a8fcc24a31bdbc0a6aad4a97d2814d74ff1b9a840ba8f32ac3b05e5a97e3f05129ded1aea7fa9935189ba2c22a156c881c5306a6bb1b89d41abf215148c038d8
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRchR8:Ts/cRLRBR4R+RlR8R9RbRYRAR8
TLSH
T145E6BF22B7E449AEC2FFD274D06206217EB1B8675326EB8B5F8045F91D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths