2026-10-25_85991ad50c3187d501ed88e3e924e36a_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-10-25_85991ad50c3187d501ed88e3e924e36a_coinminer_glassworm_poet-rat_sliver_snatch
Size 19.9MB
Sample261026-1gb1kagx21
SHA256 9a9b953bc9b77d8e030e77d8b65c855646be545b35018512564b42f77bc7c277
MD5 85991ad50c3187d501ed88e3e924e36a
SHA1 d3d68a2219f71ec3840943bb2d94a4a10538b4ff
SHA512 ad2550a7a9ba10e3e7a619737eaeb059c3d5f6f81e9750fe5f99f2d04f6b33ed57ca3d1fe59403175cb295123ebc7767bd7a6735213fe3ec2e08a589db5f07d0
SSDEEP 393216:DAkLRCR3R7R6RLRKRRRcR7RIRbRYRURYR6RWRCRNRmRsRy:EA
TLSH
T12B27CF21B7E849AAC2FFD379D06206261EF0B827622BEB4F5E8054FD1D53BD09915363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Custom signature

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_85991ad50c3187d501ed88e3e924e36a_coinminer_glassworm_poet-rat_sliver_snatch

2026-10-25_85991ad50c3187d501ed88e3e924e36a_coinminer_glassworm_poet-rat_sliver_snatch

.exe 19.9MB

SHA256 9a9b953bc9b77d8e030e77d8b65c855646be545b35018512564b42f77bc7c277
MD5 85991ad50c3187d501ed88e3e924e36a
SHA1 d3d68a2219f71ec3840943bb2d94a4a10538b4ff
SHA512 ad2550a7a9ba10e3e7a619737eaeb059c3d5f6f81e9750fe5f99f2d04f6b33ed57ca3d1fe59403175cb295123ebc7767bd7a6735213fe3ec2e08a589db5f07d0
SSDEEP 393216:DAkLRCR3R7R6RLRKRRRcR7RIRbRYRURYR6RWRCRNRmRsRy:EA
TLSH
T12B27CF21B7E849AAC2FFD379D06206261EF0B827622BEB4F5E8054FD1D53BD09915363
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths