2026-09-25_b4dd0f4c4100a55751a0ff614f135ccd_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-09-25_b4dd0f4c4100a55751a0ff614f135ccd_coinminer_glassworm_poet-rat_sliver_snatch
Size 15.2MB
Sample260925-zmlxaaxt4k
SHA256 53acf462be07fc34ce89efe11059b1fb4c81ab40e2ee5660f352de2870e72cb6
MD5 b4dd0f4c4100a55751a0ff614f135ccd
SHA1 a0ed519c91642572fabd7a971a2987879e439cfa
SHA512 15744e20331ba6b313273b31742b4a95dbf57c875c24ee7a0d6327708b8e63f2f6c1db663bd7e10048356f24a08d40f07590aa1a12fda5e7c1afb8f2a9a87ba2
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRahR9hR1hRI:/s/cRLRBR4R+RlR8R9RbRYRuRPR3RI
TLSH
T1C3F6B022B7E449AEC2FFD375D06206212EF1B8675326EB8B5F8045F91D53BD0A919323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_b4dd0f4c4100a55751a0ff614f135ccd_coinminer_glassworm_poet-rat_sliver_snatch

2026-09-25_b4dd0f4c4100a55751a0ff614f135ccd_coinminer_glassworm_poet-rat_sliver_snatch

.exe 15.2MB

SHA256 53acf462be07fc34ce89efe11059b1fb4c81ab40e2ee5660f352de2870e72cb6
MD5 b4dd0f4c4100a55751a0ff614f135ccd
SHA1 a0ed519c91642572fabd7a971a2987879e439cfa
SHA512 15744e20331ba6b313273b31742b4a95dbf57c875c24ee7a0d6327708b8e63f2f6c1db663bd7e10048356f24a08d40f07590aa1a12fda5e7c1afb8f2a9a87ba2
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRahR9hR1hRI:/s/cRLRBR4R+RlR8R9RbRYRuRPR3RI
TLSH
T1C3F6B022B7E449AEC2FFD375D06206212EF1B8675326EB8B5F8045F91D53BD0A919323
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths