General
- Target 2026-08-02_4c8e720eebf87fa8ea0eebb1c83e3ca8_cobalt-strike_coinminer_elex_frostygoop_ghostlocker_glassworm_hive_poet-rat_salatstealer_sliver_snatch
- Size 6.9MB
- Sample260802-dqkbzacd74
- SHA256 267a9dbaa86ea4c8d34e60e784fa229de81091ed01469fe2af2cbe56d17e61e5
- MD5 4c8e720eebf87fa8ea0eebb1c83e3ca8
- SHA1 737f99e40e777afbed28bf45f4e3226f9ebb0c9d
- SHA512 ae598bb3f83948527766021d090f0a68fb57f0144d9b2a924ea5030b26223b229294e600148846c3813fdd7844e950e8c2a8ca993a4431e8ae6d3af1e0fee67d
- SSDEEP 98304:5IaxaVLmcbe1EzJpb8oZvps+ACqBcRx2ArweFTdZ4LoVcxr+dsV:5IQALLTZvqPAj/zVcxP
- TLSH T166767B40F9DB64F5EA43153014B6A2AF2330BD058B28DBD7DA147F2BE8776E11E32259
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_4c8e720eebf87fa8ea0eebb1c83e3ca8_cobalt-strike_coinminer_elex_frostygoop_ghostlocker_glas.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_4c8e720eebf87fa8ea0eebb1c83e3ca8_cobalt-strike_coinminer_elex_frostygoop_ghostlocker_glassworm_hive_poet-rat_salatstealer_sliver_snatch
- Size 6.9MB
- SHA256 267a9dbaa86ea4c8d34e60e784fa229de81091ed01469fe2af2cbe56d17e61e5
- MD5 4c8e720eebf87fa8ea0eebb1c83e3ca8
- SHA1 737f99e40e777afbed28bf45f4e3226f9ebb0c9d
- SHA512 ae598bb3f83948527766021d090f0a68fb57f0144d9b2a924ea5030b26223b229294e600148846c3813fdd7844e950e8c2a8ca993a4431e8ae6d3af1e0fee67d
- SSDEEP 98304:5IaxaVLmcbe1EzJpb8oZvps+ACqBcRx2ArweFTdZ4LoVcxr+dsV:5IQALLTZvqPAj/zVcxP
- TLSH T166767B40F9DB64F5EA43153014B6A2AF2330BD058B28DBD7DA147F2BE8776E11E32259
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.