2026-10-14_c3ee3a5755b96ab396a6a2ba0cca97bb_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-10-14_c3ee3a5755b96ab396a6a2ba0cca97bb_coinminer_glassworm_poet-rat_sliver_snatch
Size 18.3MB
Sample261014-ptcbba119r
SHA256 7691018ddfa74cab8e848e048ae79c4717a37a54e084101461c81263cada91f6
MD5 c3ee3a5755b96ab396a6a2ba0cca97bb
SHA1 8a8d059e09917dbd3de7c9a03ab8c82361d48a81
SHA512 ce9513276263eba6cda11deb24379b602ed4a417b65e204c8aa9602e9e1dc5ce444cbf691da17fe65c449d37a76772756bd21119b505f17ea094dfb2fda206f3
SSDEEP 393216:DAkLRCR3R7R6RLRyR1RpR4ROR+RqRdRgRxR0RDRG:EU
TLSH
T13617C031B7E849AAC2BFD379D06206262EF0B8276326EB4F5E8054FD1D53BD09915363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-14_c3ee3a5755b96ab396a6a2ba0cca97bb_coinminer_glassworm_poet-rat_sliver_snatch

2026-10-14_c3ee3a5755b96ab396a6a2ba0cca97bb_coinminer_glassworm_poet-rat_sliver_snatch

.exe 18.3MB

SHA256 7691018ddfa74cab8e848e048ae79c4717a37a54e084101461c81263cada91f6
MD5 c3ee3a5755b96ab396a6a2ba0cca97bb
SHA1 8a8d059e09917dbd3de7c9a03ab8c82361d48a81
SHA512 ce9513276263eba6cda11deb24379b602ed4a417b65e204c8aa9602e9e1dc5ce444cbf691da17fe65c449d37a76772756bd21119b505f17ea094dfb2fda206f3
SSDEEP 393216:DAkLRCR3R7R6RLRyR1RpR4ROR+RqRdRgRxR0RDRG:EU
TLSH
T13617C031B7E849AAC2BFD379D06206262EF0B8276326EB4F5E8054FD1D53BD09915363
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths