Extracted

• • Target
    2026-06-04_c312d07cd50d7a8457405767d8c5d285_cobalt-strike_elex_frostygoop_hive_salatstealer_sliver_snatch
  • Size 2.5MB
  • SHA256 ec11251c4cce49996205c7ecb897f85202e9a67aedf4c67c16c803b428269b54
  • MD5 c312d07cd50d7a8457405767d8c5d285
  • SHA1 37c31369432d028ac47cfa4b38f142a323e42004
  • SHA512 3e2b392d49e05d722acb30d36b00841244e736c764c713dc5cc29e6f5ea12138da826a00984eedc40f16fcc32fa9415186278e05128356a521b6990d930203ba
  • SSDEEP 24576:lbnF+kV0Nj6FCcW7pvtl60NfKrD/YasAdsdQqWppkLABn9h/9Att1nesX917Mypd:leHhAdsR0P/+zFdaO36eYD1VMs+
  • TLSH
    T186C58E40F8D76871D552667124B772BA233678050F3DEA83DEA06E7EAC3B3D21C63A45
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryspywarestealeradwaredefense_evasionexecutionpersistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2