2026-09-26_4be7ce3fbf9e292b04f8c318a5dd5edc_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-09-26_4be7ce3fbf9e292b04f8c318a5dd5edc_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Size 9.2MB
Sample260926-291eashb24
SHA256 cee9fd0b147982a8589750bdcbe0af0cd66edc567e39af1f85968838667f4326
MD5 4be7ce3fbf9e292b04f8c318a5dd5edc
SHA1 bba6c325642bee6032698c09bc19541edddf72ae
SHA512 9f0a2572cda71fd3460e0888c4147dfb4a6fe7fb43d335b11588a70f90a51d2697a1ebb9df0031eae5d68352d006adc9acc53143e84dc0423698a957ce3f3857
SSDEEP 196608:mbDkZphgT73KxRyfCfShR7hRihRwhRthRV:wABcRNRGRsR/RV
TLSH
T1D5A69E32FAE514EAC2BFE174C16257217EB2747B4331BB875F8049A91A12FD0AD2D352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-26_4be7ce3fbf9e292b04f8c318a5dd5edc_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

2026-09-26_4be7ce3fbf9e292b04f8c318a5dd5edc_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

.exe 9.2MB

SHA256 cee9fd0b147982a8589750bdcbe0af0cd66edc567e39af1f85968838667f4326
MD5 4be7ce3fbf9e292b04f8c318a5dd5edc
SHA1 bba6c325642bee6032698c09bc19541edddf72ae
SHA512 9f0a2572cda71fd3460e0888c4147dfb4a6fe7fb43d335b11588a70f90a51d2697a1ebb9df0031eae5d68352d006adc9acc53143e84dc0423698a957ce3f3857
SSDEEP 196608:mbDkZphgT73KxRyfCfShR7hRihRwhRthRV:wABcRNRGRsR/RV
TLSH
T1D5A69E32FAE514EAC2BFE174C16257217EB2747B4331BB875F8049A91A12FD0AD2D352
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths