2026-10-28_c36f0a6971c898be1ca6ee4e242dbad3_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-10-28_c36f0a6971c898be1ca6ee4e242dbad3_coinminer_glassworm_poet-rat_sliver_snatch
Size 15.2MB
Sample261029-xymlvaet41
SHA256 587b10cdfa2faa7988d45eb8f431dd5005b75bbbd9daa9bd861c69e3f56bcf14
MD5 c36f0a6971c898be1ca6ee4e242dbad3
SHA1 3f981266505c3b706914829c0f9aadae8e125466
SHA512 08ab0b8bd94f1d74c04657e3f140644a363afe9229c1a3a544585fb46019e0e7f7325c276899666d34f5865229b83a06d023d0d93f145aa83634043c0aafa6d1
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRahR9WhRDhRK:/s/cRLRBR4R+RlR8R9RbRYRuRMRlRK
TLSH
T16CF6C022B7E849AEC2FFD375D06206212EF1B8675326EB8B5F8045F91D53BD09919323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Custom signature

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_c36f0a6971c898be1ca6ee4e242dbad3_coinminer_glassworm_poet-rat_sliver_snatch

2026-10-28_c36f0a6971c898be1ca6ee4e242dbad3_coinminer_glassworm_poet-rat_sliver_snatch

.exe 15.2MB

SHA256 587b10cdfa2faa7988d45eb8f431dd5005b75bbbd9daa9bd861c69e3f56bcf14
MD5 c36f0a6971c898be1ca6ee4e242dbad3
SHA1 3f981266505c3b706914829c0f9aadae8e125466
SHA512 08ab0b8bd94f1d74c04657e3f140644a363afe9229c1a3a544585fb46019e0e7f7325c276899666d34f5865229b83a06d023d0d93f145aa83634043c0aafa6d1
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRahR9WhRDhRK:/s/cRLRBR4R+RlR8R9RbRYRuRMRlRK
TLSH
T16CF6C022B7E849AEC2FFD375D06206212EF1B8675326EB8B5F8045F91D53BD09919323
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths