2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch
Size 15.1MB
Sample261102-mble6aa19q
SHA256 542cbc594ae2fdfdc139a4d11d0beb8a4e7456c46d83a29aa7cc5a22e73c874c
MD5 bc0053913ffaab0e45254fc48b9237cb
SHA1 9e60bb37a115ab30322cd13288074896e14ac613
SHA512 f2d5436772cc9bc4259dc91070be5bd7516b97075f71fb09903616b93ccb8383026acc73aed5ffbd9272b72cf77b80a897ef02930dd7817e977686d0912550cb
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRnhRchRihRbhRYhRuhRRhRPhR9hRHhRWhRz:Ts/cRLRhRARGRtRkRKRbRZRPRBRCRz
TLSH
T1ABF6C022B7E849AEC2FFD375D06206212EF1B8675326EB8B5E8045F91D53BD09D19323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch

2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch

.exe 15.1MB

SHA256 542cbc594ae2fdfdc139a4d11d0beb8a4e7456c46d83a29aa7cc5a22e73c874c
MD5 bc0053913ffaab0e45254fc48b9237cb
SHA1 9e60bb37a115ab30322cd13288074896e14ac613
SHA512 f2d5436772cc9bc4259dc91070be5bd7516b97075f71fb09903616b93ccb8383026acc73aed5ffbd9272b72cf77b80a897ef02930dd7817e977686d0912550cb
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRnhRchRihRbhRYhRuhRRhRPhR9hRHhRWhRz:Ts/cRLRhRARGRtRkRKRbRZRPRBRCRz
TLSH
T1ABF6C022B7E849AEC2FFD375D06206212EF1B8675326EB8B5E8045F91D53BD09D19323
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths