General
- Target 2026-10-23_a1a14d5d61774cc0ebc2069d3d63a7bd_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 9.2MB
- Sample261023-k2pt6axtcx
- SHA256 8c1e807fac43207a97b6432d9f706ad40e0f0d0b630babde5fd5da75d131fa97
- MD5 a1a14d5d61774cc0ebc2069d3d63a7bd
- SHA1 fabd08974d710cd62f1f28d89a2085c9c26dce3a
- SHA512 d70126caee32c8a050ce00920d21e1c5c0ce5d429bd5e6cee2440ca8d2a2a699df42b0ee051349f1e5fadaa0596803f956f4f8bf16ba439734eef98d761e2baf
- SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRNhRMhR6:Ts/cRLRBRfRwR6
- TLSH T143A6AE33FAE504EAC6BEE274C06253217EB17C674331BB875F9055B91A62BD0AE2D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-10-23_a1a14d5d61774cc0ebc2069d3d63a7bd_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-23_a1a14d5d61774cc0ebc2069d3d63a7bd_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-23_a1a14d5d61774cc0ebc2069d3d63a7bd_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 9.2MB
- SHA256 8c1e807fac43207a97b6432d9f706ad40e0f0d0b630babde5fd5da75d131fa97
- MD5 a1a14d5d61774cc0ebc2069d3d63a7bd
- SHA1 fabd08974d710cd62f1f28d89a2085c9c26dce3a
- SHA512 d70126caee32c8a050ce00920d21e1c5c0ce5d429bd5e6cee2440ca8d2a2a699df42b0ee051349f1e5fadaa0596803f956f4f8bf16ba439734eef98d761e2baf
- SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRNhRMhR6:Ts/cRLRBRfRwR6
- TLSH T143A6AE33FAE504EAC6BEE274C06253217EB17C674331BB875F9055B91A62BD0AE2D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables referencing virtualization MAC addresses
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory