2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Size 9.3MB
Sample261006-t4eawaff23
SHA256 4e22234cd19e81f32fd829ccb292c5fbb8b4d0e4dc18fa20716366afae5493f8
MD5 b56ae4fe003cc92cf69938e5116ab728
SHA1 f8bd747c39b8077b168c44bd7b63a1a0a3dba53e
SHA512 b51344687fdb7919f2798b7fe3ae1307e57764f37f8e0d8ea65897c879a072f4226373947fe97ef9acdd96c04e44985f576ce62a79e9112e77f5f1a0b59e2a72
SSDEEP 196608:mbDkZphgT73KxRyfCfShR7hRihR0hR6hRD:wABcRNRGRIRORD
TLSH
T19CA69E32FAE514EAC2BFE174C16257217EB2747B4331BB875F8049A91A12FD0AD2D352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

.exe 9.3MB

SHA256 4e22234cd19e81f32fd829ccb292c5fbb8b4d0e4dc18fa20716366afae5493f8
MD5 b56ae4fe003cc92cf69938e5116ab728
SHA1 f8bd747c39b8077b168c44bd7b63a1a0a3dba53e
SHA512 b51344687fdb7919f2798b7fe3ae1307e57764f37f8e0d8ea65897c879a072f4226373947fe97ef9acdd96c04e44985f576ce62a79e9112e77f5f1a0b59e2a72
SSDEEP 196608:mbDkZphgT73KxRyfCfShR7hRihR0hR6hRD:wABcRNRGRIRORD
TLSH
T19CA69E32FAE514EAC2BFE174C16257217EB2747B4331BB875F8049A91A12FD0AD2D352
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths