46649b42b0491ff3f976b01fde601a6e60955089658d7aa9014d8edc4b4022fd

General

Target
2026-06-03_a658b3a2c8437497a04f0f5613c16d60_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch
Size 2.0MB
Sample260603-w2b4vaev3q
SHA256 46649b42b0491ff3f976b01fde601a6e60955089658d7aa9014d8edc4b4022fd
MD5 a658b3a2c8437497a04f0f5613c16d60
SHA1 c6887bef04184bfe9a5981255639e0e790ae96ed
SHA512 d1f37f9e100df37c3f477e300ec40b2b3dc970351cbe0e99fc977072c85a0ea07a0e548f3593a4bc39506f4acb4d0382a2efde23083fa89bec13131be3bad13d
SSDEEP 49152:yPrTjBei3fRDTCBaQsUVfv5cmGA9qNMMMZgT0dw:4NPRnCHdSMA
TLSH
T1BDA59D477CC414B5E5FAA2328EB511917771F8890B3227C32E19A2B92F773D84E76398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-03_a658b3a2c8437497a04f0f5613c16d60_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch
- Size 2.0MB
- SHA256 46649b42b0491ff3f976b01fde601a6e60955089658d7aa9014d8edc4b4022fd
- MD5 a658b3a2c8437497a04f0f5613c16d60
- SHA1 c6887bef04184bfe9a5981255639e0e790ae96ed
- SHA512 d1f37f9e100df37c3f477e300ec40b2b3dc970351cbe0e99fc977072c85a0ea07a0e548f3593a4bc39506f4acb4d0382a2efde23083fa89bec13131be3bad13d
- SSDEEP 49152:yPrTjBei3fRDTCBaQsUVfv5cmGA9qNMMMZgT0dw:4NPRnCHdSMA
- TLSH
  T1BDA59D477CC414B5E5FAA2328EB511917771F8890B3227C32E19A2B92F773D84E76398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Custom signature
  
  Detects Windows executables referencing non-Windows User-Agents
- Custom signature
  
  Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2