2026-10-10_0bf99f495b9f829a7371444b76139902_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-10-10_0bf99f495b9f829a7371444b76139902_coinminer_glassworm_poet-rat_sliver_snatch
Size 15.1MB
Sample261011-1lbwcsds71
SHA256 601c43f3c91a8d7dffe275636d1813702947cd53798a6d0f1a77a7694a0a1456
MD5 0bf99f495b9f829a7371444b76139902
SHA1 46dc2833f1a2de06cae55afbeb634de753f78e8f
SHA512 dbfdb15de9401cb452dd2535bc4c6a4596b0adfd821c49363ffa3758718281d34815f117659a89ad9f548e93c4973a7d321514cbb73e4efa5843399d1ba830b8
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRNhRjhRBhRa:/s/cRLRBR4R+RlR8R9RbRYRfRFRLRa
TLSH
T1D3F6C022B7E449AEC2FFD375D06206212EF1B8675326EB8B5F8045F91D53BD0A919323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_0bf99f495b9f829a7371444b76139902_coinminer_glassworm_poet-rat_sliver_snatch

2026-10-10_0bf99f495b9f829a7371444b76139902_coinminer_glassworm_poet-rat_sliver_snatch

.exe 15.1MB

SHA256 601c43f3c91a8d7dffe275636d1813702947cd53798a6d0f1a77a7694a0a1456
MD5 0bf99f495b9f829a7371444b76139902
SHA1 46dc2833f1a2de06cae55afbeb634de753f78e8f
SHA512 dbfdb15de9401cb452dd2535bc4c6a4596b0adfd821c49363ffa3758718281d34815f117659a89ad9f548e93c4973a7d321514cbb73e4efa5843399d1ba830b8
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRNhRjhRBhRa:/s/cRLRBR4R+RlR8R9RbRYRfRFRLRa
TLSH
T1D3F6C022B7E449AEC2FFD375D06206212EF1B8675326EB8B5F8045F91D53BD0A919323
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths