2026-11-12_6ab855975990d3f5dd0c880c7558915e_coinminer_glassworm_poet-rat_sliver_snatch

General

Target
2026-11-12_6ab855975990d3f5dd0c880c7558915e_coinminer_glassworm_poet-rat_sliver_snatch
Size 14.4MB
Sample261113-bcb3bses4w
SHA256 fd5d59ca89970bdb72432e29beca24f43a6b8c74efd64cfcb51794d5d6e0307b
MD5 6ab855975990d3f5dd0c880c7558915e
SHA1 6ed78d6ff9de39aea4fd62764b2261ae63f0e1c3
SHA512 8a2a4c38c033f6a943d321886d9195bc613c4522bf51b7d6610d7bb204acd8dd1272d7aa15f936a65ee7963ad503672c4fc72167a9d84a628e3dc569f446b4af
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhRdhR5hRXhR1:/s/cRLRBR4R+RlR8R9RbRvRzRRR1
TLSH
T1F6E6CF22B7E449AEC2FFD275D06206213EF1B8675326EB8B5F8045F91D53BD0A919323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Custom signature

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_6ab855975990d3f5dd0c880c7558915e_coinminer_glassworm_poet-rat_sliver_snatch

2026-11-12_6ab855975990d3f5dd0c880c7558915e_coinminer_glassworm_poet-rat_sliver_snatch

.exe 14.4MB

SHA256 fd5d59ca89970bdb72432e29beca24f43a6b8c74efd64cfcb51794d5d6e0307b
MD5 6ab855975990d3f5dd0c880c7558915e
SHA1 6ed78d6ff9de39aea4fd62764b2261ae63f0e1c3
SHA512 8a2a4c38c033f6a943d321886d9195bc613c4522bf51b7d6610d7bb204acd8dd1272d7aa15f936a65ee7963ad503672c4fc72167a9d84a628e3dc569f446b4af
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhRdhR5hRXhR1:/s/cRLRBR4R+RlR8R9RbRvRzRRR1
TLSH
T1F6E6CF22B7E449AEC2FFD275D06206213EF1B8675326EB8B5F8045F91D53BD0A919323
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

363296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths