2026-11-01_bba20752691463a8c78d6582f47d5309_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-11-01_bba20752691463a8c78d6582f47d5309_coinminer_glassworm_poet-rat_sliver_snatch
Size 13.7MB
Sample261102-mcghlagy6v
SHA256 5da843de659ce75ddfcf0a6790dee140bec780f96655866d4f3629b68037f855
MD5 bba20752691463a8c78d6582f47d5309
SHA1 7d3638e80f2279b3240d5ca78d5bc13962f64095
SHA512 34e6376f6d22d24fda9e707bfa86c9713c9d3d560ed2c6e4d4db9e33cef3b62f29a06717b779c1c52e6720b030d6bcb181e5a95e2eb2625f535a08898a185918
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRnhRchRihRbhRYhRuhRRhRPhRuhRR:/s/cRLRhRARGRtRkRKRbRZRKRR
TLSH
T1EFE6BF32B7E449AAC2FFD274D06206217EB1B8675326EB8B5F8045F91D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Custom signature

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_bba20752691463a8c78d6582f47d5309_coinminer_glassworm_poet-rat_sliver_snatch

2026-11-01_bba20752691463a8c78d6582f47d5309_coinminer_glassworm_poet-rat_sliver_snatch

.exe 13.7MB

SHA256 5da843de659ce75ddfcf0a6790dee140bec780f96655866d4f3629b68037f855
MD5 bba20752691463a8c78d6582f47d5309
SHA1 7d3638e80f2279b3240d5ca78d5bc13962f64095
SHA512 34e6376f6d22d24fda9e707bfa86c9713c9d3d560ed2c6e4d4db9e33cef3b62f29a06717b779c1c52e6720b030d6bcb181e5a95e2eb2625f535a08898a185918
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRnhRchRihRbhRYhRuhRRhRPhRuhRR:/s/cRLRhRARGRtRkRKRbRZRKRR
TLSH
T1EFE6BF32B7E449AAC2FFD274D06206217EB1B8675326EB8B5F8045F91D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths