2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Size 13.7MB
Sample260930-e7p48axerb
SHA256 4e4a2bf0ecf3213d406260b49a5c43840cec3f37b50a7fcf1a0b5b1fb9be0ee8
MD5 1fb4a360d2c332ba72774087a4518d11
SHA1 512a83241390cdf5dfc80c067b07b088b0e1effd
SHA512 1f354a410d90d27311fbfad0f9e86c7297e3ba87b5f5abf6cd16bf5e9d308efeb144efb86f4caf2875599f49a54a8a63291e180c39afce34727e32bf0f0b6701
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRNhRU:Ts/cRLRBR4R+RlR8R9RbRYRfRU
TLSH
T1D0E6BF22B7E449AEC2FFD274D06206217EB1B8675326EB8B5F8045F91D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

.exe 13.7MB

SHA256 4e4a2bf0ecf3213d406260b49a5c43840cec3f37b50a7fcf1a0b5b1fb9be0ee8
MD5 1fb4a360d2c332ba72774087a4518d11
SHA1 512a83241390cdf5dfc80c067b07b088b0e1effd
SHA512 1f354a410d90d27311fbfad0f9e86c7297e3ba87b5f5abf6cd16bf5e9d308efeb144efb86f4caf2875599f49a54a8a63291e180c39afce34727e32bf0f0b6701
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRNhRU:Ts/cRLRBR4R+RlR8R9RbRYRfRU
TLSH
T1D0E6BF22B7E449AEC2FFD274D06206217EB1B8675326EB8B5F8045F91D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths