2026-10-02_f7815f6ff28a2ff60a6822edb3789640_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-10-02_f7815f6ff28a2ff60a6822edb3789640_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Size 7.7MB
Sample261002-16bq4athja
SHA256 3ab0356225561786b0942c21d84b960cff35f10fba8686a28dc909f4b1a02ce4
MD5 f7815f6ff28a2ff60a6822edb3789640
SHA1 d6252a6ec136f34bc71ba6fe54326efb041bf923
SHA512 f37f9932ab59a2967b0ce3e8678fe86e3ee3b5b2ce9cee58383dc0618c4bc015765fc9c2bcd861b20c6218e69e7fc9b6fbc12a5f3f856f1bbb8ebec4f3308c38
SSDEEP 98304:/w+sy5q1SGkDwVBTwPwYfwjsCkpL2OPXYSDDSDchR9SDoSDchRaSDchRv:I+D5q1SGs2yRwtkpqShR5hR0hRv
TLSH
T1D8869D33F9E504EAC6BEE174C16253227E717C674331BB875F8055AA1A62BD0BE2E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_f7815f6ff28a2ff60a6822edb3789640_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

2026-10-02_f7815f6ff28a2ff60a6822edb3789640_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

.exe 7.7MB

SHA256 3ab0356225561786b0942c21d84b960cff35f10fba8686a28dc909f4b1a02ce4
MD5 f7815f6ff28a2ff60a6822edb3789640
SHA1 d6252a6ec136f34bc71ba6fe54326efb041bf923
SHA512 f37f9932ab59a2967b0ce3e8678fe86e3ee3b5b2ce9cee58383dc0618c4bc015765fc9c2bcd861b20c6218e69e7fc9b6fbc12a5f3f856f1bbb8ebec4f3308c38
SSDEEP 98304:/w+sy5q1SGkDwVBTwPwYfwjsCkpL2OPXYSDDSDchR9SDoSDchRaSDchRv:I+D5q1SGs2yRwtkpqShR5hR0hRv
TLSH
T1D8869D33F9E504EAC6BEE174C16253227E717C674331BB875F8055AA1A62BD0BE2E311
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths