General
- Target 2026-09-28_05fa8e017f7ad5533d43d0d6f19ecd9e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 8.5MB
- Sample260929-phyeea1y3q
- SHA256 fd215375b3172f6318c0d58133f4df5afead6d6207f7533424edfd653a3bdc1c
- MD5 05fa8e017f7ad5533d43d0d6f19ecd9e
- SHA1 3715465e6c242107d73567849f0e263b336b773c
- SHA512 7148d0b8dee801f807de6a43a8a2193e514fa0caf569543c61a3a27e1cbb25d34506f38aa5cc4ecdb8c952762e39d9f100ecfe720eb1fd7af477f68aa76b8fce
- SSDEEP 98304:LCbD4VZphgb/cc3oXlxRLT6fC93BnXASDchRXSDchRgSDchRWSDchR8:mbDkZphgT73KxRyfCfShR7hRihRwhR8
- TLSH T120968D32FAE514EAC2BEE170C16257217EB2747B43317B875F8059AA1A22FD0BD2D351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-28_05fa8e017f7ad5533d43d0d6f19ecd9e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-28_05fa8e017f7ad5533d43d0d6f19ecd9e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-28_05fa8e017f7ad5533d43d0d6f19ecd9e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 8.5MB
- SHA256 fd215375b3172f6318c0d58133f4df5afead6d6207f7533424edfd653a3bdc1c
- MD5 05fa8e017f7ad5533d43d0d6f19ecd9e
- SHA1 3715465e6c242107d73567849f0e263b336b773c
- SHA512 7148d0b8dee801f807de6a43a8a2193e514fa0caf569543c61a3a27e1cbb25d34506f38aa5cc4ecdb8c952762e39d9f100ecfe720eb1fd7af477f68aa76b8fce
- SSDEEP 98304:LCbD4VZphgb/cc3oXlxRLT6fC93BnXASDchRXSDchRgSDchRWSDchR8:mbDkZphgT73KxRyfCfShR7hRihRwhR8
- TLSH T120968D32FAE514EAC2BEE170C16257217EB2747B43317B875F8059AA1A22FD0BD2D351
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables referencing virtualization MAC addresses
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory