Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - resource tags
arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system - submitted
27/08/2025, 03:45
General
- Target 2025-08-27_700ac871e15cd1e998dd3f1093cfe97f_cobalt-strike_frostygoop_gcleaner_ghostlocker_luca-stealer_snatch.exe
- Size 3.4MB
- Sample250827-ea4aksfp4w
- SHA256 7bb81249dcb9f33737cadefb227e33404233bee36e69351de8e66a6832aae57b
- MD5 700ac871e15cd1e998dd3f1093cfe97f
- SHA1 a951e3da0fac55c83d4f59403f36411d5f2d49ac
- SHA512 344e541bd86c830710e104ae92949a202e144ba054a9351d507a08100aa81c2df89112700e55d7308cb15b58243a9f118c4593a7fc6e8a27e0e7a69a3a4568ed
- SSDEEP 49152:BWNkL63FYeg+rb/TxvO90d7HjmAFd4A64nsfJkPJfQ4Idg/w7Lvy6nD1kSKXqy1W:k3BIPj8X1Kz0zDIKPK
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-08-27_700ac871e15cd1e998dd3f1093cfe97f_cobalt-strike_frostygoop_gcleaner_ghostlocker_luca-stealer_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-08-27_700ac871e15cd1e998dd3f1093cfe97f_cobalt-strike_frostygoop_gcleaner_ghostlocker_luca-stealer_snatch.exe"1⤵PID:3356