2026-09-28_05fa8e017f7ad5533d43d0d6f19ecd9e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-09-28_05fa8e017f7ad5533d43d0d6f19ecd9e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Size 8.5MB
Sample260929-phyeea1y3q
SHA256 fd215375b3172f6318c0d58133f4df5afead6d6207f7533424edfd653a3bdc1c
MD5 05fa8e017f7ad5533d43d0d6f19ecd9e
SHA1 3715465e6c242107d73567849f0e263b336b773c
SHA512 7148d0b8dee801f807de6a43a8a2193e514fa0caf569543c61a3a27e1cbb25d34506f38aa5cc4ecdb8c952762e39d9f100ecfe720eb1fd7af477f68aa76b8fce
SSDEEP 98304:LCbD4VZphgb/cc3oXlxRLT6fC93BnXASDchRXSDchRgSDchRWSDchR8:mbDkZphgT73KxRyfCfShR7hRihRwhR8
TLSH
T120968D32FAE514EAC2BEE170C16257217EB2747B43317B875F8059AA1A22FD0BD2D351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_05fa8e017f7ad5533d43d0d6f19ecd9e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

2026-09-28_05fa8e017f7ad5533d43d0d6f19ecd9e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

.exe 8.5MB

SHA256 fd215375b3172f6318c0d58133f4df5afead6d6207f7533424edfd653a3bdc1c
MD5 05fa8e017f7ad5533d43d0d6f19ecd9e
SHA1 3715465e6c242107d73567849f0e263b336b773c
SHA512 7148d0b8dee801f807de6a43a8a2193e514fa0caf569543c61a3a27e1cbb25d34506f38aa5cc4ecdb8c952762e39d9f100ecfe720eb1fd7af477f68aa76b8fce
SSDEEP 98304:LCbD4VZphgb/cc3oXlxRLT6fC93BnXASDchRXSDchRgSDchRWSDchR8:mbDkZphgT73KxRyfCfShR7hRihRwhR8
TLSH
T120968D32FAE514EAC2BEE170C16257217EB2747B43317B875F8059AA1A22FD0BD2D351
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths