General
- Target 2026-07-07_3ba0fe68d042287b38457e54fa3315a2_cobalt-strike_frostygoop_glassworm_hive_icedid_luca-stealer_njrat_poet-rat_salatstealer_sliver_snatch_vidar
- Size 8.3MB
- Sample260707-rs6vmsft8z
- SHA256 c6633dfebee868a91b7563ec66bc4376e450d9ce997c6097637c550503585b8c
- MD5 3ba0fe68d042287b38457e54fa3315a2
- SHA1 87f0ea50aa1fc60d4bcac4b007100550840d0471
- SHA512 a21cee97374c81e9be8e91665153e79aa1ef91fa84f7d85a09bfd955d918bd66cfe1db54b4b844ff50d9477c22759b3f9349d42a3c49e2787f4eb5b3c64cd66e
- SSDEEP 98304:Fv3K0YyOAYcd0ZLpNu6JmM1W8YcTpOG7ZE78ROLsnTRZa8v0:FPzUwsFYc9OG7ZE78REsnVb
- TLSH T18B96F5C2AC4147A4CC5983FCC9E592B26670BC4C0FA197F73630F6A96A766DC5A36F10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-07_3ba0fe68d042287b38457e54fa3315a2_cobalt-strike_frostygoop_glassworm_hive_icedid_luca-stea.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_3ba0fe68d042287b38457e54fa3315a2_cobalt-strike_frostygoop_glassworm_hive_icedid_luca-stea.exe
Resource
win11ltsc2024-20260706-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-07_3ba0fe68d042287b38457e54fa3315a2_cobalt-strike_frostygoop_glassworm_hive_icedid_luca-stealer_njrat_poet-rat_salatstealer_sliver_snatch_vidar
- Size 8.3MB
- SHA256 c6633dfebee868a91b7563ec66bc4376e450d9ce997c6097637c550503585b8c
- MD5 3ba0fe68d042287b38457e54fa3315a2
- SHA1 87f0ea50aa1fc60d4bcac4b007100550840d0471
- SHA512 a21cee97374c81e9be8e91665153e79aa1ef91fa84f7d85a09bfd955d918bd66cfe1db54b4b844ff50d9477c22759b3f9349d42a3c49e2787f4eb5b3c64cd66e
- SSDEEP 98304:Fv3K0YyOAYcd0ZLpNu6JmM1W8YcTpOG7ZE78ROLsnTRZa8v0:FPzUwsFYc9OG7ZE78REsnVb
- TLSH T18B96F5C2AC4147A4CC5983FCC9E592B26670BC4C0FA197F73630F6A96A766DC5A36F10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.