General
- Target 2026-06-03_c07458a9ecde39e41022fb1236e2e5ef_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch
- Size 2.0MB
- Sample260603-2fsglae12w
- SHA256 24b841e5616f7a8f3d59f201133a0e9672b8fd99a2aebfd2acb4dbc539f6efff
- MD5 c07458a9ecde39e41022fb1236e2e5ef
- SHA1 c12f124bdb2e7a866469dd2f55d8d1698030f2f5
- SHA512 a15cf19dfbe506222aa2914caee9295446edca298bc3c13392d83b4f85c6c4b3aed52f64abc9328af815a194cae9a2d95219693813e07ac7738d3a39939e7a8a
- SSDEEP 24576:mlEmqT++E2aiKOdb5vzKvb/dpXLhYZC4PpAXaxTNp2d3EF4bCnJ/6ZgT0gw88:mmmC++EhiD1kbThY4IJLp9FnMZgT0M8
- TLSH T141A5AD07BCC465B9C5EA93328EB511913771F8891B3137C72A65A2B92FB73C40EB5398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-03_c07458a9ecde39e41022fb1236e2e5ef_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-03_c07458a9ecde39e41022fb1236e2e5ef_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
Resource
win11-20260513-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-03_c07458a9ecde39e41022fb1236e2e5ef_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch
- Size 2.0MB
- SHA256 24b841e5616f7a8f3d59f201133a0e9672b8fd99a2aebfd2acb4dbc539f6efff
- MD5 c07458a9ecde39e41022fb1236e2e5ef
- SHA1 c12f124bdb2e7a866469dd2f55d8d1698030f2f5
- SHA512 a15cf19dfbe506222aa2914caee9295446edca298bc3c13392d83b4f85c6c4b3aed52f64abc9328af815a194cae9a2d95219693813e07ac7738d3a39939e7a8a
- SSDEEP 24576:mlEmqT++E2aiKOdb5vzKvb/dpXLhYZC4PpAXaxTNp2d3EF4bCnJ/6ZgT0gw88:mmmC++EhiD1kbThY4IJLp9FnMZgT0M8
- TLSH T141A5AD07BCC465B9C5EA93328EB511913771F8891B3137C72A65A2B92FB73C40EB5398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
-
Suspicious use of NtSetInformationThreadHideFromDebugger