2026-11-02_f3bba54e278d6a51d48324452ceb5eb8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-11-02_f3bba54e278d6a51d48324452ceb5eb8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
Size 13.2MB
Sample261102-ww48faet5n
SHA256 bcf971f59db9f085842ed1bcd36494b0a46faa809b6499c07b5622947d3f82e7
MD5 f3bba54e278d6a51d48324452ceb5eb8
SHA1 3631f877d6c423967114982162ed87e2f4e780d5
SHA512 64360389c95caae5e1cd72731f83c0b0eebb0babde7506482ec945ed72b640aeac3cd02ed4987a006787e8ad8f0470126dc68f98065e7e30ea84104b0ce70082
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRnhRchRihRbhRYhRohR+hRihRB:Ts/cRLRhRARGRtRkR0RaRGRB
TLSH
T112D6BF22B7E549AAC2FFD274C06206217EB1B8675326FB8B5F8045F91D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_f3bba54e278d6a51d48324452ceb5eb8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

2026-11-02_f3bba54e278d6a51d48324452ceb5eb8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch

.exe 13.2MB

SHA256 bcf971f59db9f085842ed1bcd36494b0a46faa809b6499c07b5622947d3f82e7
MD5 f3bba54e278d6a51d48324452ceb5eb8
SHA1 3631f877d6c423967114982162ed87e2f4e780d5
SHA512 64360389c95caae5e1cd72731f83c0b0eebb0babde7506482ec945ed72b640aeac3cd02ed4987a006787e8ad8f0470126dc68f98065e7e30ea84104b0ce70082
SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRnhRchRihRbhRYhRohR+hRihRB:Ts/cRLRhRARGRtRkR0RaRGRB
TLSH
T112D6BF22B7E549AAC2FFD274C06206217EB1B8675326FB8B5F8045F91D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths