61ed703f0bcb4baf9a90fc8ce8ca0a2fb7db558cf493d3d2920f442f884ab00e

General

Target
2026-06-02_9f65fda2bb79d64f821b32c4a0cc85dc_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch
Size 2.3MB
Sample260602-1l86vset4z
SHA256 61ed703f0bcb4baf9a90fc8ce8ca0a2fb7db558cf493d3d2920f442f884ab00e
MD5 9f65fda2bb79d64f821b32c4a0cc85dc
SHA1 a861c8f252faf868795fdeeb5917e0d5ea363280
SHA512 da9d2446f16589dd20170c6eb73393a2ab3cddf90e9c2a7df90a13297840319a21a650ba5a1a8fc80ae078d1125bccbaec483b4b87e4b21338b7d70d02d685ff
SSDEEP 49152:/dZuOt2Yguhf2i21FjFsqXf8wO4rvZgRAbD4D1O:x2YjmWqPYM
TLSH
T10AB58D47BC9424B6C5EAD23289B652A17B70B8490F3127C72E56A3B93F737D40E35398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-02_9f65fda2bb79d64f821b32c4a0cc85dc_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch
- Size 2.3MB
- SHA256 61ed703f0bcb4baf9a90fc8ce8ca0a2fb7db558cf493d3d2920f442f884ab00e
- MD5 9f65fda2bb79d64f821b32c4a0cc85dc
- SHA1 a861c8f252faf868795fdeeb5917e0d5ea363280
- SHA512 da9d2446f16589dd20170c6eb73393a2ab3cddf90e9c2a7df90a13297840319a21a650ba5a1a8fc80ae078d1125bccbaec483b4b87e4b21338b7d70d02d685ff
- SSDEEP 49152:/dZuOt2Yguhf2i21FjFsqXf8wO4rvZgRAbD4D1O:x2YjmWqPYM
- TLSH
  T10AB58D47BC9424B6C5EAD23289B652A17B70B8490F3127C72E56A3B93F737D40E35398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2