09fb65d6020326fe9fe737679374eb5757ad769944f07cb7307c65c109d3ff78

Analysis

max time kernel
149s
max time network
101s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 12:30

Target
2026-06-05_32565b1877b4b5aed23ef867f56e6cd0_cobalt-strike_coinminer_dosia_frostygoop_hive_luca-steal.exe
Size 14.9MB
Sample260605-ppmaqagw7j
SHA256 09fb65d6020326fe9fe737679374eb5757ad769944f07cb7307c65c109d3ff78
MD5 32565b1877b4b5aed23ef867f56e6cd0
SHA1 e87374d7651b5279086123addded2d2c6f06204c
SHA512 553cd7867a926ecfec9e1cbe179577faf493b144e29ef4c37d896cbf7587fc9f175f999bb3d28fd0ef7600f436299696382a11ef12cf00f2fe9be263bb175d84
SSDEEP 196608:fBq1XP8NJkZTNCUGVB0/B5J8MsFtI/VGlPBz8:5q1p8U55FYB
TLSH
T1DFF60903E8D514D4C8F9D1B489214222FA7178581B7933DB6BA1F7B42B32BF45EBA790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

flow	ioc
1	2.tcp.eu.ngrok.io

C:\Users\Admin\AppData\Local\Temp\2026-06-05_32565b1877b4b5aed23ef867f56e6cd0_cobalt-strike_coinminer_dosia_frostygoop_hive_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-05_32565b1877b4b5aed23ef867f56e6cd0_cobalt-strike_coinminer_dosia_frostygoop_hive_luca-steal.exe"
1⤵
PID:4440

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact