a87911e368afd9b50f7abcc7351c0154e1ba508c974d7b6660deaec5a398a77c

General

Target
2026-06-02_0a38e537bb50f2f6645a690ab213e03e_cobalt-strike_snatch
Size 2.4MB
Sample260602-aqdmmsbs3m
SHA256 a87911e368afd9b50f7abcc7351c0154e1ba508c974d7b6660deaec5a398a77c
MD5 0a38e537bb50f2f6645a690ab213e03e
SHA1 324414148b67683b45fdb61ce972e97b6221e5c1
SHA512 df3b7ebaaac108e4b60d436a58e56990603aacb125b9432190ae19b3c22339e8ad2e4df0666e57bc7ed55026bf0ce8b7fb2ee1fcd5f8aae447c11167313f082f
SSDEEP 24576:KU0bXaP26ryYWmDJkf+RtlhxqkBzZfyaMHx+KqSgJqwelLUnUx0gDfHruwPK1D:KzzaP24yuDDxFzZqHeJqwTDgDfvPK1D
TLSH
T16AC539877962F1A0D864B1F7246381703B24BC247B75A7F72A9D21B60B725C809F7FA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-02_0a38e537bb50f2f6645a690ab213e03e_cobalt-strike_snatch
- Size 2.4MB
- SHA256 a87911e368afd9b50f7abcc7351c0154e1ba508c974d7b6660deaec5a398a77c
- MD5 0a38e537bb50f2f6645a690ab213e03e
- SHA1 324414148b67683b45fdb61ce972e97b6221e5c1
- SHA512 df3b7ebaaac108e4b60d436a58e56990603aacb125b9432190ae19b3c22339e8ad2e4df0666e57bc7ed55026bf0ce8b7fb2ee1fcd5f8aae447c11167313f082f
- SSDEEP 24576:KU0bXaP26ryYWmDJkf+RtlhxqkBzZfyaMHx+KqSgJqwelLUnUx0gDfHruwPK1D:KzzaP24yuDDxFzZqHeJqwTDgDfvPK1D
- TLSH
  T16AC539877962F1A0D864B1F7246381703B24BC247B75A7F72A9D21B60B725C809F7FA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2