ligolo | 2026-07-15_4196682be71c7f3821b32d86bda6a851_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_4196682be71c7f3821b32d86bda6a851_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 6.9MB
Sample260716-aeka2sb18x
SHA256 660fa382dff3e4ea255708ae9681bf1acfa33a35047ba22aa6bdd4ea2828e56d
MD5 4196682be71c7f3821b32d86bda6a851
SHA1 71556dec1a94e4b20a9fc179504fcaf1ec35e269
SHA512 924ca9784ac6881c9faef06d92da353b730e598a2944d81d9bdedde03ea9fdaf11e16d525803aa95b5131a760f61d4cb283aa362cfbaa3663a3b72ab8b59ae11
SSDEEP 49152:jB0/9jWG1pyQHEiIa+JHD7UMg7d7vP5FnY6DyCKgkp7Vgh64uMXpV97VmSoEwKey:j+IVx7UTTY64VoE65/V+nE
TLSH
T1F1765B03EC9115E9C0E9D2358A62D253BA717C495B3263EB3B50F7682F73BD0AA78750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor ligolo

Malware Config

Signatures

Family: Ligolo
Ligolo is a cross-platform and an open-source reverse tunneling tool written in Golang .
backdoor ligolo

Detects Ligolo reverse tunneling tool 1 IoCs

resource	yara_rule
sample	family_ligolo

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_4196682be71c7f3821b32d86bda6a851_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch

File Explorer

2026-07-15_4196682be71c7f3821b32d86bda6a851_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch

.exe 6.9MB

2026-07-15_4196682be71c7f3821b32d86bda6a851_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 660fa382dff3e4ea255708ae9681bf1acfa33a35047ba22aa6bdd4ea2828e56d
MD5 4196682be71c7f3821b32d86bda6a851
SHA1 71556dec1a94e4b20a9fc179504fcaf1ec35e269
SHA512 924ca9784ac6881c9faef06d92da353b730e598a2944d81d9bdedde03ea9fdaf11e16d525803aa95b5131a760f61d4cb283aa362cfbaa3663a3b72ab8b59ae11
SSDEEP 49152:jB0/9jWG1pyQHEiIa+JHD7UMg7d7vP5FnY6DyCKgkp7Vgh64uMXpV97VmSoEwKey:j+IVx7UTTY64VoE65/V+nE
TLSH
T1F1765B03EC9115E9C0E9D2358A62D253BA717C495B3263EB3B50F7682F73BD0AA78750
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Ligolo reverse tunneling tool
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

491008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

377KB

Virtual Size

723KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-07-15_4196682be71c7f3821b32d86bda6a851_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch

kernel32

generic