General
- Target 2026-08-19_88f1391dd0129ffb439c51bf78a1a53a_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver
- Size 81.1MB
- Sample260819-ftp3qsxckd
- SHA256 a1fe75867f04e2d702d99815730276ad1ba4017aa85012ab0efc3e6fadc4f177
- MD5 88f1391dd0129ffb439c51bf78a1a53a
- SHA1 fdcc6269b57242908c71d57650c2220464cbb9de
- SHA512 28ea03ae901b7ce7d47dcc59f8480ea1fa5df0be2fc102f2510c7128ff97501d60df6656ac70227324d40c42e02fbbb0f391f26469e0008d974a4d1cf21a2ac5
- SSDEEP 1572864:QbKBUum7mKL90N0A6Rfg9g0IB16bpa2s/4RsdbYOIdPu0:4KeF7CN0AkB16bhsTdBGPu0
- TLSH T1CA1833077E9592B4D19AE134996A1201B731BC99473537C33F89E7B81F32BC06E7A7A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_88f1391dd0129ffb439c51bf78a1a53a_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_88f1391dd0129ffb439c51bf78a1a53a_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_88f1391dd0129ffb439c51bf78a1a53a_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver
- Size 81.1MB
- SHA256 a1fe75867f04e2d702d99815730276ad1ba4017aa85012ab0efc3e6fadc4f177
- MD5 88f1391dd0129ffb439c51bf78a1a53a
- SHA1 fdcc6269b57242908c71d57650c2220464cbb9de
- SHA512 28ea03ae901b7ce7d47dcc59f8480ea1fa5df0be2fc102f2510c7128ff97501d60df6656ac70227324d40c42e02fbbb0f391f26469e0008d974a4d1cf21a2ac5
- SSDEEP 1572864:QbKBUum7mKL90N0A6Rfg9g0IB16bpa2s/4RsdbYOIdPu0:4KeF7CN0AkB16bhsTdBGPu0
- TLSH T1CA1833077E9592B4D19AE134996A1201B731BC99473537C33F89E7B81F32BC06E7A7A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Suspicious use of NtSetInformationThreadHideFromDebugger