2026-10-23_a1a14d5d61774cc0ebc2069d3d63a7bd_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-10-23_a1a14d5d61774cc0ebc2069d3d63a7bd_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Size 9.2MB
Sample261023-k2pt6axtcx
SHA256 8c1e807fac43207a97b6432d9f706ad40e0f0d0b630babde5fd5da75d131fa97
MD5 a1a14d5d61774cc0ebc2069d3d63a7bd
SHA1 fabd08974d710cd62f1f28d89a2085c9c26dce3a
SHA512 d70126caee32c8a050ce00920d21e1c5c0ce5d429bd5e6cee2440ca8d2a2a699df42b0ee051349f1e5fadaa0596803f956f4f8bf16ba439734eef98d761e2baf
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRNhRMhR6:Ts/cRLRBRfRwR6
TLSH
T143A6AE33FAE504EAC6BEE274C06253217EB17C674331BB875F9055B91A62BD0AE2D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_a1a14d5d61774cc0ebc2069d3d63a7bd_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

2026-10-23_a1a14d5d61774cc0ebc2069d3d63a7bd_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

.exe 9.2MB

SHA256 8c1e807fac43207a97b6432d9f706ad40e0f0d0b630babde5fd5da75d131fa97
MD5 a1a14d5d61774cc0ebc2069d3d63a7bd
SHA1 fabd08974d710cd62f1f28d89a2085c9c26dce3a
SHA512 d70126caee32c8a050ce00920d21e1c5c0ce5d429bd5e6cee2440ca8d2a2a699df42b0ee051349f1e5fadaa0596803f956f4f8bf16ba439734eef98d761e2baf
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRNhRMhR6:Ts/cRLRBRfRwR6
TLSH
T143A6AE33FAE504EAC6BEE274C06253217EB17C674331BB875F9055B91A62BD0AE2D311
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths