General
- Target 2026-07-15_3b08eea0915af1bef4d0a0dd7c70b5e7_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver
- Size 2.1MB
- Sample260715-dkejjadt4y
- SHA256 ee468f6b5b28106fcd3d13f13076eb763724a371b67a7fdbd988105785df8fdf
- MD5 3b08eea0915af1bef4d0a0dd7c70b5e7
- SHA1 acb4d6ffc6206f3214a7ace4d0d295a72cd93861
- SHA512 71f20ba407e1af4a20a39a9d4006028bd9713b4043138e81395cdf70bd06784042881a5ab0170a5aae7796d30b8dc02bc4e760b9c0f0626796d4f7daca4338b0
- SSDEEP 49152:NpAFy6Lac5jfWcrb/TLvO90d7HjmAFd4A64nsfJ+Q7Zg1eBV10fYD1:i5y
- TLSH T1ABA55A46B89554B5D0AED2328AA6A2917B717C940F3127CB3B90B3F82F737D46E75308
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-15_3b08eea0915af1bef4d0a0dd7c70b5e7_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-15_3b08eea0915af1bef4d0a0dd7c70b5e7_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-07-15_3b08eea0915af1bef4d0a0dd7c70b5e7_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver
- Size 2.1MB
- SHA256 ee468f6b5b28106fcd3d13f13076eb763724a371b67a7fdbd988105785df8fdf
- MD5 3b08eea0915af1bef4d0a0dd7c70b5e7
- SHA1 acb4d6ffc6206f3214a7ace4d0d295a72cd93861
- SHA512 71f20ba407e1af4a20a39a9d4006028bd9713b4043138e81395cdf70bd06784042881a5ab0170a5aae7796d30b8dc02bc4e760b9c0f0626796d4f7daca4338b0
- SSDEEP 49152:NpAFy6Lac5jfWcrb/TLvO90d7HjmAFd4A64nsfJ+Q7Zg1eBV10fYD1:i5y
- TLSH T1ABA55A46B89554B5D0AED2328AA6A2917B717C940F3127CB3B90B3F82F737D46E75308
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Indirect Command Execution
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
MITRE ATT&CK Enterprise v16
Defense Evasion
Indicator Removal
1File Deletion
1Indirect Command Execution
1Modify Registry
1