General
- Target 2026-11-12_6ab855975990d3f5dd0c880c7558915e_coinminer_glassworm_poet-rat_sliver_snatch
- Size 14.4MB
- Sample261113-bcb3bses4w
- SHA256 fd5d59ca89970bdb72432e29beca24f43a6b8c74efd64cfcb51794d5d6e0307b
- MD5 6ab855975990d3f5dd0c880c7558915e
- SHA1 6ed78d6ff9de39aea4fd62764b2261ae63f0e1c3
- SHA512 8a2a4c38c033f6a943d321886d9195bc613c4522bf51b7d6610d7bb204acd8dd1272d7aa15f936a65ee7963ad503672c4fc72167a9d84a628e3dc569f446b4af
- SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhRdhR5hRXhR1:/s/cRLRBR4R+RlR8R9RbRvRzRRR1
- TLSH T1F6E6CF22B7E449AEC2FFD275D06206213EF1B8675326EB8B5F8045F91D53BD0A919323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-11-12_6ab855975990d3f5dd0c880c7558915e_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-12_6ab855975990d3f5dd0c880c7558915e_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-12_6ab855975990d3f5dd0c880c7558915e_coinminer_glassworm_poet-rat_sliver_snatch
- Size 14.4MB
- SHA256 fd5d59ca89970bdb72432e29beca24f43a6b8c74efd64cfcb51794d5d6e0307b
- MD5 6ab855975990d3f5dd0c880c7558915e
- SHA1 6ed78d6ff9de39aea4fd62764b2261ae63f0e1c3
- SHA512 8a2a4c38c033f6a943d321886d9195bc613c4522bf51b7d6610d7bb204acd8dd1272d7aa15f936a65ee7963ad503672c4fc72167a9d84a628e3dc569f446b4af
- SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhRdhR5hRXhR1:/s/cRLRBR4R+RlR8R9RbRvRzRRR1
- TLSH T1F6E6CF22B7E449AEC2FFD275D06206213EF1B8675326EB8B5F8045F91D53BD0A919323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detects executables referencing virtualization MAC addresses
Adds Run key to start application
Drops desktop.ini file(s)
Drops file in System32 directory