General
- Target 2026-11-01_8fdf206eae5ac768733cb39b0ff629c5_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 10.9MB
- Sample261102-scmbqsvsfs
- SHA256 fdbbe531c043b06536a0caa1aa371289f3d381e76c735856c89a3b2c0cefc375
- MD5 8fdf206eae5ac768733cb39b0ff629c5
- SHA1 028fddb639cf13d2858c5d665953f0ffe0bd23cc
- SHA512 7839a2ac489bd2916816594f79618abbbcc038a6ea01779ed344e0bfd7cd9f7c039b5fde10e0790a42e97ae3acbe57efe0022cb6a988f8fba5cfc0b133c48cf3
- SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRnhRPhRRhR0hRahRI:Ts/cRLRhRZRbRIRuRI
- TLSH T19AB6B032F6E505AEC2BEE274C06253217EB1B8574326BB8B5F8055F91D63BD0AD2D312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-11-01_8fdf206eae5ac768733cb39b0ff629c5_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_8fdf206eae5ac768733cb39b0ff629c5_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-01_8fdf206eae5ac768733cb39b0ff629c5_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
- Size 10.9MB
- SHA256 fdbbe531c043b06536a0caa1aa371289f3d381e76c735856c89a3b2c0cefc375
- MD5 8fdf206eae5ac768733cb39b0ff629c5
- SHA1 028fddb639cf13d2858c5d665953f0ffe0bd23cc
- SHA512 7839a2ac489bd2916816594f79618abbbcc038a6ea01779ed344e0bfd7cd9f7c039b5fde10e0790a42e97ae3acbe57efe0022cb6a988f8fba5cfc0b133c48cf3
- SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRnhRPhRRhR0hRahRI:Ts/cRLRhRZRbRIRuRI
- TLSH T19AB6B032F6E505AEC2BEE274C06253217EB1B8574326BB8B5F8055F91D63BD0AD2D312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables referencing virtualization MAC addresses
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory