2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Size 10.4MB
Sample261101-2b72gsfv8m
SHA256 5720fc55c493ff4f67f682014f236b18579f1b951c25a70ec9da47c5b8185c0f
MD5 9b98c560a4b72858f4289d003f400d71
SHA1 a9cb38bd173170ff1513be680bd0e0ba35bd480b
SHA512 55c3c774061f87cd1b81879e6901307bc79c082cbfc2a8a0cd722f420f29257b9a25d8e82eabaac0f87c066de847fe2623fd7cf2adc1e234052f929682a3210a
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhR1hRThRFhRN:/s/cRLRBR4R3R1RHRN
TLSH
T1BFB6AF32F6E505EAC6BEE274C06253217EB17C574332BB8B5F8055B91A63BD0AD2D312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Custom signature

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

.exe 10.4MB

SHA256 5720fc55c493ff4f67f682014f236b18579f1b951c25a70ec9da47c5b8185c0f
MD5 9b98c560a4b72858f4289d003f400d71
SHA1 a9cb38bd173170ff1513be680bd0e0ba35bd480b
SHA512 55c3c774061f87cd1b81879e6901307bc79c082cbfc2a8a0cd722f420f29257b9a25d8e82eabaac0f87c066de847fe2623fd7cf2adc1e234052f929682a3210a
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhR1hRThRFhRN:/s/cRLRBR4R3R1RHRN
TLSH
T1BFB6AF32F6E505EAC6BEE274C06253217EB17C574332BB8B5F8055B91A63BD0AD2D312
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths