2026-09-29_43d478ce9f74b63bbe9b93d3e7ab6144_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-09-29_43d478ce9f74b63bbe9b93d3e7ab6144_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Size 13.7MB
Sample260930-1fl45sws8l
SHA256 66ed984b333131d5e6914bf94cb9c160aafdfd6c6f0c23335aeb7e9f3620f6d2
MD5 43d478ce9f74b63bbe9b93d3e7ab6144
SHA1 5262647ec7e26fc8e02d61dbb0cb6fd87a9ecc02
SHA512 910ef9bc5c2205799ba57f486c7b529494ddba13e57253ff2deb471d15efe8d154b37e5f878dc280290eb195eadbc76d6a2058460e8e726eb4fe182c9ec5f093
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRNhRr:Ts/cRLRBR4R+RlR8R9RbRYRfRr
TLSH
T13FE6BF22B7E449AAC2FFD274D06206217EB1B8675326FB8B5F8045F91D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_43d478ce9f74b63bbe9b93d3e7ab6144_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

2026-09-29_43d478ce9f74b63bbe9b93d3e7ab6144_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

.exe 13.7MB

SHA256 66ed984b333131d5e6914bf94cb9c160aafdfd6c6f0c23335aeb7e9f3620f6d2
MD5 43d478ce9f74b63bbe9b93d3e7ab6144
SHA1 5262647ec7e26fc8e02d61dbb0cb6fd87a9ecc02
SHA512 910ef9bc5c2205799ba57f486c7b529494ddba13e57253ff2deb471d15efe8d154b37e5f878dc280290eb195eadbc76d6a2058460e8e726eb4fe182c9ec5f093
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRNhRr:Ts/cRLRBR4R+RlR8R9RbRYRfRr
TLSH
T13FE6BF22B7E449AAC2FFD274D06206217EB1B8675326FB8B5F8045F91D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths