Analysis
- max time kernel
148s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20250314-en - resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system - submitted
17/03/2025, 21:29
Behavioral task
behavioral1
Sample
2025-03-17_904db6af7e16574112c036ef4f8c5c14_cobalt-strike_frostygoop_gcleaner_ghostlocker_luca-stealer_snatch.exe
Resource
win7-20240729-en
0 signatures
150 seconds
General
- Target 2025-03-17_904db6af7e16574112c036ef4f8c5c14_cobalt-strike_frostygoop_gcleaner_ghostlocker_luca-stealer_snatch.exe
- Size 3.4MB
- Sample250317-1b446askz5
- SHA256 e5187e878fcc81ced95da96761b999e8b9296094289b6e62aeb6a8fc8b77f93d
- MD5 904db6af7e16574112c036ef4f8c5c14
- SHA1 c6ac6b9d712224b9b4a1d1049f6afa496b9dd33f
- SHA512 175e38dc5963f4fa96d6b5654751c9db9c8a49e28bded80ffc7d975eaf979ff31ed3f942b7ab372921fb26d78e38645d5552c28aa051de7a451ff8b1623e4c6d
- SSDEEP 49152:BWNkL63FYeg+rb/TxvO90d7HjmAFd4A64nsfJkPJfQ4Idg/w7LvyenD1kSKXqy1W:k3BIPD8X1Kz0zDIKPK
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-17_904db6af7e16574112c036ef4f8c5c14_cobalt-strike_frostygoop_gcleaner_ghostlocker_luca-stealer_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-17_904db6af7e16574112c036ef4f8c5c14_cobalt-strike_frostygoop_gcleaner_ghostlocker_luca-stealer_snatch.exe"1⤵PID:1488