2026-09-30_c071b4fff9820a8ee63aa2f5254d3ef9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-09-30_c071b4fff9820a8ee63aa2f5254d3ef9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Size 13.7MB
Sample261001-hk2fhsch68
SHA256 ef323bc2899b9a5dad1ab16b3511757489a92be9931e685c501cecc1118a2411
MD5 c071b4fff9820a8ee63aa2f5254d3ef9
SHA1 1ddae6cc569deb88bb6ccd22152070b58f09bd86
SHA512 2c984acf7b903db370ef6b7d51e1b372da43edf3c4e1f90ee4f6c780d53018d4e36916cd113547335adfbe9c5dc8fcc49ade0c11da5b29aaca4f36cc5eaf85fa
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRNhRG:Ts/cRLRBR4R+RlR8R9RbRYRfRG
TLSH
T131E6BF22B7E449AAC2FFD274D06206217EB1B8675326FB8B5F8045F91D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_c071b4fff9820a8ee63aa2f5254d3ef9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

2026-09-30_c071b4fff9820a8ee63aa2f5254d3ef9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

.exe 13.7MB

SHA256 ef323bc2899b9a5dad1ab16b3511757489a92be9931e685c501cecc1118a2411
MD5 c071b4fff9820a8ee63aa2f5254d3ef9
SHA1 1ddae6cc569deb88bb6ccd22152070b58f09bd86
SHA512 2c984acf7b903db370ef6b7d51e1b372da43edf3c4e1f90ee4f6c780d53018d4e36916cd113547335adfbe9c5dc8fcc49ade0c11da5b29aaca4f36cc5eaf85fa
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRNhRG:Ts/cRLRBR4R+RlR8R9RbRYRfRG
TLSH
T131E6BF22B7E449AAC2FFD274D06206217EB1B8675326FB8B5F8045F91D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths