2026-10-10_509256a0689581fd8d88002c1eba880c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-10-10_509256a0689581fd8d88002c1eba880c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Size 12.5MB
Sample261011-rm127sba79
SHA256 798784a17db53a8c8eb0426a335e5aad9adff0e5dc4654603566907fed13c04b
MD5 509256a0689581fd8d88002c1eba880c
SHA1 6220ebbfc227a0fb001fb2782ca0dba33dffb45f
SHA512 b6e8f60e279f5164a3c2856434f90c7a77c190384ae48f845be789b043ab7e08d0d445f1e8b23c25a6f8855630da4dcb93dff504ba27a1f8d66a7fd50a127225
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRw:/s/cRLRBR4R+RlR8R9RbRYRw
TLSH
T15FD6BF32B6E545AAC2FFE274C06206217EB1B8675326FB8B5F8045F91D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_509256a0689581fd8d88002c1eba880c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

2026-10-10_509256a0689581fd8d88002c1eba880c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

.exe 12.5MB

SHA256 798784a17db53a8c8eb0426a335e5aad9adff0e5dc4654603566907fed13c04b
MD5 509256a0689581fd8d88002c1eba880c
SHA1 6220ebbfc227a0fb001fb2782ca0dba33dffb45f
SHA512 b6e8f60e279f5164a3c2856434f90c7a77c190384ae48f845be789b043ab7e08d0d445f1e8b23c25a6f8855630da4dcb93dff504ba27a1f8d66a7fd50a127225
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRw:/s/cRLRBR4R+RlR8R9RbRYRw
TLSH
T15FD6BF32B6E545AAC2FFE274C06206217EB1B8675326FB8B5F8045F91D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths