General
- Target 2026-08-19_cbea3e6ac3138f90a80b58801b0f9328_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver
- Size 87.0MB
- Sample260819-ezjmgawfpc
- SHA256 a319ef01ee7ecb9dc0db706e820ca526e652aaa7587eb1bf2cf8cdcc4e50389a
- MD5 cbea3e6ac3138f90a80b58801b0f9328
- SHA1 403415517cf0fcd087f82d6c982c21f0a26ce0cc
- SHA512 faf3c3b54f81461a3aa59056807c114fe496c510858b44bccc1e4cacf25a41975d40ca2ffe9fa87e8097262a281e23ab21edde26a629f5807d6e8f5b53f9c0a8
- SSDEEP 1572864:Zt/gQbO8HgPId6B5iELFlIvPB79lZ7RLSRqX/kMY9g5lLktgGC5fa7cdjR33vk:f/jypgd6iELHIvJ79lZ7RLBX/kMmuSCe
- TLSH T1481833077D8059A1D5EAE6308AB61250BA30BC8D0F3237D76F41B6F12E32BD15E76B94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_cbea3e6ac3138f90a80b58801b0f9328_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_cbea3e6ac3138f90a80b58801b0f9328_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_cbea3e6ac3138f90a80b58801b0f9328_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver
- Size 87.0MB
- SHA256 a319ef01ee7ecb9dc0db706e820ca526e652aaa7587eb1bf2cf8cdcc4e50389a
- MD5 cbea3e6ac3138f90a80b58801b0f9328
- SHA1 403415517cf0fcd087f82d6c982c21f0a26ce0cc
- SHA512 faf3c3b54f81461a3aa59056807c114fe496c510858b44bccc1e4cacf25a41975d40ca2ffe9fa87e8097262a281e23ab21edde26a629f5807d6e8f5b53f9c0a8
- SSDEEP 1572864:Zt/gQbO8HgPId6B5iELFlIvPB79lZ7RLSRqX/kMY9g5lLktgGC5fa7cdjR33vk:f/jypgd6iELHIvJ79lZ7RLBX/kMmuSCe
- TLSH T1481833077D8059A1D5EAE6308AB61250BA30BC8D0F3237D76F41B6F12E32BD15E76B94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Suspicious use of NtSetInformationThreadHideFromDebugger