2026-10-23_33169060a15f557c78d8f2ab169e8387_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-10-23_33169060a15f557c78d8f2ab169e8387_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Size 9.2MB
Sample261023-qwpvvsda29
SHA256 2df62bfb6499418e3b79f009aac42fb0a9c378716fe723329fc9140b6d533033
MD5 33169060a15f557c78d8f2ab169e8387
SHA1 eb114bb63e7215234d73ed3b515a07d1414b6237
SHA512 c8317e590a4c41fdd871fd6e665aca9cc5447c1c189f699d241355043b6a7faf4bc455e66c91265edd666aa191a7e98333a84fed1d3bfe407f59a3ef9ba37a2e
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRNhRMhRt:Ts/cRLRBRfRwRt
TLSH
T12EA6AE33FAE504EAC6BEE274C06257217EB17C674331BB875F8055B91A62BD0AE2D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_33169060a15f557c78d8f2ab169e8387_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

2026-10-23_33169060a15f557c78d8f2ab169e8387_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

.exe 9.2MB

SHA256 2df62bfb6499418e3b79f009aac42fb0a9c378716fe723329fc9140b6d533033
MD5 33169060a15f557c78d8f2ab169e8387
SHA1 eb114bb63e7215234d73ed3b515a07d1414b6237
SHA512 c8317e590a4c41fdd871fd6e665aca9cc5447c1c189f699d241355043b6a7faf4bc455e66c91265edd666aa191a7e98333a84fed1d3bfe407f59a3ef9ba37a2e
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRNhRMhRt:Ts/cRLRBRfRwRt
TLSH
T12EA6AE33FAE504EAC6BEE274C06257217EB17C674331BB875F8055B91A62BD0AE2D311
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths