2026-10-10_4a30a9d5ed5cc0aa550d6eab30c18146_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-10-10_4a30a9d5ed5cc0aa550d6eab30c18146_coinminer_glassworm_poet-rat_sliver_snatch
Size 15.0MB
Sample261011-sdctpas1gy
SHA256 2f1acba0c4a2c373a688bdaf610d14e9dd48cc056ac584b7e03b9e67a3d8df6d
MD5 4a30a9d5ed5cc0aa550d6eab30c18146
SHA1 469578ad33f1b0e560eebbe9c4379a6ec703f034
SHA512 79692f501c601c3dad8b4f26af97923dfcd2c7b57a608ff7b8918ada422b61e0807516caa7216f014f63a5448a64bf66424234d28ee88598cbd93971b6416f31
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRNhRUhRbhRK:/s/cRLRBR4R+RlR8R9RbRYRfRoRtRK
TLSH
T14CF6B022B7E449AEC2FFD375D06206212EF1B8675326EB8B5F8045F91D53BD0A919323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_4a30a9d5ed5cc0aa550d6eab30c18146_coinminer_glassworm_poet-rat_sliver_snatch

2026-10-10_4a30a9d5ed5cc0aa550d6eab30c18146_coinminer_glassworm_poet-rat_sliver_snatch

.exe 15.0MB

SHA256 2f1acba0c4a2c373a688bdaf610d14e9dd48cc056ac584b7e03b9e67a3d8df6d
MD5 4a30a9d5ed5cc0aa550d6eab30c18146
SHA1 469578ad33f1b0e560eebbe9c4379a6ec703f034
SHA512 79692f501c601c3dad8b4f26af97923dfcd2c7b57a608ff7b8918ada422b61e0807516caa7216f014f63a5448a64bf66424234d28ee88598cbd93971b6416f31
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRNhRUhRbhRK:/s/cRLRBR4R+RlR8R9RbRYRfRoRtRK
TLSH
T14CF6B022B7E449AEC2FFD375D06206212EF1B8675326EB8B5F8045F91D53BD0A919323
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths