2026-09-29_8c8ed912888cae5b8d0333c8481e4f43_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-09-29_8c8ed912888cae5b8d0333c8481e4f43_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Size 13.6MB
Sample260930-xc32psww3k
SHA256 1ebcfb1ffca352d7d8959433b209e2950d988afda91a57f7c57dc59e9155420b
MD5 8c8ed912888cae5b8d0333c8481e4f43
SHA1 a6b9748c3a43651bfac90ad6cecee0fe4b4592f9
SHA512 f4fd9bacf7d0af5fb42ec659e5e7534c56493a3993340151b0987b27f275306063d2f5a4834f10f0399ff00b2d43360fa20bb51b5d5ea4161949809634e08b95
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRNhRt:Ts/cRLRBR4R+RlR8R9RbRYRfRt
TLSH
T1A1E6BF22B7E449AEC2FFD274D06206217EB1B8675326EB8B5F8045F91D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_8c8ed912888cae5b8d0333c8481e4f43_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

2026-09-29_8c8ed912888cae5b8d0333c8481e4f43_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

.exe 13.6MB

SHA256 1ebcfb1ffca352d7d8959433b209e2950d988afda91a57f7c57dc59e9155420b
MD5 8c8ed912888cae5b8d0333c8481e4f43
SHA1 a6b9748c3a43651bfac90ad6cecee0fe4b4592f9
SHA512 f4fd9bacf7d0af5fb42ec659e5e7534c56493a3993340151b0987b27f275306063d2f5a4834f10f0399ff00b2d43360fa20bb51b5d5ea4161949809634e08b95
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRNhRt:Ts/cRLRBR4R+RlR8R9RbRYRfRt
TLSH
T1A1E6BF22B7E449AEC2FFD274D06206217EB1B8675326EB8B5F8045F91D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths