General
- Target 2026-08-19_0589414f30ca83bc646de627b0cb8ac5_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver
- Size 86.1MB
- Sample260819-hehffsyepa
- SHA256 a7958373c13cbb6a18e65c6d98f1d9780b9263c34597658298e23d8f84142a6d
- MD5 0589414f30ca83bc646de627b0cb8ac5
- SHA1 a0800615e0b36ffd5b02695a7a96feb951b2d63a
- SHA512 348f0323f6ddb4448d6b17073d346fc23acecdfb1d0279b92c9aebe6a3ab2c4b6bc05cc3b323a4f6b6fe74397b1cc1af9931f56fdd1c0a67bb3ccbe0f463f950
- SSDEEP 1572864:/5Ia7hR0mgmCR7A9C/wFe3/eS3bRJHIXmhxEj3UhomsPbyfpRtlGutMh:rhFjCYFe3m6r7xEljh
- TLSH T15B183317BD8991B4D59AE13189661211B734BC98073137C33F9ABBB42F327C16E3AB81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_0589414f30ca83bc646de627b0cb8ac5_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_0589414f30ca83bc646de627b0cb8ac5_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_0589414f30ca83bc646de627b0cb8ac5_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver
- Size 86.1MB
- SHA256 a7958373c13cbb6a18e65c6d98f1d9780b9263c34597658298e23d8f84142a6d
- MD5 0589414f30ca83bc646de627b0cb8ac5
- SHA1 a0800615e0b36ffd5b02695a7a96feb951b2d63a
- SHA512 348f0323f6ddb4448d6b17073d346fc23acecdfb1d0279b92c9aebe6a3ab2c4b6bc05cc3b323a4f6b6fe74397b1cc1af9931f56fdd1c0a67bb3ccbe0f463f950
- SSDEEP 1572864:/5Ia7hR0mgmCR7A9C/wFe3/eS3bRJHIXmhxEj3UhomsPbyfpRtlGutMh:rhFjCYFe3m6r7xEljh
- TLSH T15B183317BD8991B4D59AE13189661211B734BC98073137C33F9ABBB42F327C16E3AB81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Suspicious use of NtSetInformationThreadHideFromDebugger