b0cf13898f47bd979435a9c98bcda87bc080f9ce52151b05e94ad6ede767b662

General

Target
2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch
Size 2.6MB
Sample260605-tplfmsaz4v
SHA256 b0cf13898f47bd979435a9c98bcda87bc080f9ce52151b05e94ad6ede767b662
MD5 b89e401bfb55d5278b31e5dd49628c18
SHA1 83b3065e571b2964e1aea671ef4a0566a3eb1959
SHA512 ee351def15a41f95525a483e056b91776d629670521b7d33875d071b08b54835a1d44e051746787f2f048769a195ad694e634b52464e4451fe0eb98beaee7e56
SSDEEP 49152:cdN3Brb/TYvO90dL3BmAFd4A64nsfJniZY7cN2N5FgOLe+2xMKhNyxB3iLQ8QkjF:83J7LNyMlmskJPeNk
TLSH
T102C59E02F55160BAD4D9E6318566E181326138180F363BE37F95BABA1EF77C04F397A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-05_b89e401bfb55d5278b31e5dd49628c18_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch
- Size 2.6MB
- SHA256 b0cf13898f47bd979435a9c98bcda87bc080f9ce52151b05e94ad6ede767b662
- MD5 b89e401bfb55d5278b31e5dd49628c18
- SHA1 83b3065e571b2964e1aea671ef4a0566a3eb1959
- SHA512 ee351def15a41f95525a483e056b91776d629670521b7d33875d071b08b54835a1d44e051746787f2f048769a195ad694e634b52464e4451fe0eb98beaee7e56
- SSDEEP 49152:cdN3Brb/TYvO90dL3BmAFd4A64nsfJniZY7cN2N5FgOLe+2xMKhNyxB3iLQ8QkjF:83J7LNyMlmskJPeNk
- TLSH
  T102C59E02F55160BAD4D9E6318566E181326138180F363BE37F95BABA1EF77C04F397A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution persistence spyware stealer themida trojan
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Detects executables packed with Themida
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2