General
- Target 2026-09-29_1fcab2ce5f419c603289ca11fce3fb1c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 8.5MB
- Sample260930-e7k59ssxat
- SHA256 356ea71dd7564140557a2aa4db3defe4950b410dff7ead7551b01d63c021694b
- MD5 1fcab2ce5f419c603289ca11fce3fb1c
- SHA1 01a27049061baa38237641d91641729a0363cd3d
- SHA512 8dc17c76a7219ffe5831b317d54dd5a37678573e12997626ce933014951f5abcff03c89974fd4b71f9af951caf6a1eea5c4bb62d80446c201475f3b737eac887
- SSDEEP 98304:LCbD4VZphgb/cc3oXlxRLT6fC93BnXASDchRXSDchRgSDchRJSDchRX:mbDkZphgT73KxRyfCfShR7hRihRdhRX
- TLSH T185968D32FAE514EAC2BEE170C16257217EB2747B43317B875F8059AA1A22FD0BD2D351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-29_1fcab2ce5f419c603289ca11fce3fb1c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_1fcab2ce5f419c603289ca11fce3fb1c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-29_1fcab2ce5f419c603289ca11fce3fb1c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 8.5MB
- SHA256 356ea71dd7564140557a2aa4db3defe4950b410dff7ead7551b01d63c021694b
- MD5 1fcab2ce5f419c603289ca11fce3fb1c
- SHA1 01a27049061baa38237641d91641729a0363cd3d
- SHA512 8dc17c76a7219ffe5831b317d54dd5a37678573e12997626ce933014951f5abcff03c89974fd4b71f9af951caf6a1eea5c4bb62d80446c201475f3b737eac887
- SSDEEP 98304:LCbD4VZphgb/cc3oXlxRLT6fC93BnXASDchRXSDchRgSDchRJSDchRX:mbDkZphgT73KxRyfCfShR7hRihRdhRX
- TLSH T185968D32FAE514EAC2BEE170C16257217EB2747B43317B875F8059AA1A22FD0BD2D351
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables referencing virtualization MAC addresses
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory