7e0fe767724a5c52fb25f6ce902ffc95e0d2b1fdea895600f2212dda855c6c68

General

Target
2026-06-04_d6b97c41b81fd78a624c0f0b510e4d42_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch
Size 2.7MB
Sample260604-e1l4zsaz5l
SHA256 7e0fe767724a5c52fb25f6ce902ffc95e0d2b1fdea895600f2212dda855c6c68
MD5 d6b97c41b81fd78a624c0f0b510e4d42
SHA1 159c11182623aa141693f7f3e6deb28f6399c926
SHA512 553b55c1c1a13589f76449dde91c1f77fdbf069b9053c5ada89c0262a965c9273812c09360d10f7369b4a90542f05083853c84722ef424ce5ef33c0da95a172f
SSDEEP 49152:FLJN37rb/TIvO90dL3BmAFd4A64nsfJWQXfSS7G1zWp7JMw54pr7Fg7ZgbQC/D1b:FP3hSWGomg7P4
TLSH
T1B5D57D427880217DC9D9F23199B5B1A1B730B8150F3A2BC32B56AEB52D377D82F36B54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-04_d6b97c41b81fd78a624c0f0b510e4d42_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch
- Size 2.7MB
- SHA256 7e0fe767724a5c52fb25f6ce902ffc95e0d2b1fdea895600f2212dda855c6c68
- MD5 d6b97c41b81fd78a624c0f0b510e4d42
- SHA1 159c11182623aa141693f7f3e6deb28f6399c926
- SHA512 553b55c1c1a13589f76449dde91c1f77fdbf069b9053c5ada89c0262a965c9273812c09360d10f7369b4a90542f05083853c84722ef424ce5ef33c0da95a172f
- SSDEEP 49152:FLJN37rb/TIvO90dL3BmAFd4A64nsfJWQXfSS7G1zWp7JMw54pr7Fg7ZgbQC/D1b:FP3hSWGomg7P4
- TLSH
  T1B5D57D427880217DC9D9F23199B5B1A1B730B8150F3A2BC32B56AEB52D377D82F36B54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Detects Windows executables referencing non-Windows User-Agents
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2