General
- Target 2026-08-19_c042d6ebb1a5b01bc6f202561334aa49_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver
- Size 87.5MB
- Sample260819-m15v4aee26
- SHA256 1ad922bd4858460edcdd47621f7329df6327d778e2af804c93adf2afa2cdfa21
- MD5 c042d6ebb1a5b01bc6f202561334aa49
- SHA1 3646cd6bd340b9b6f3575eee8ccc295eb9989da7
- SHA512 2ebc7bf2a12f80bf8eaf83bae59ac94cd9c4933e47ed76a1d9c670b4cef4602402d7e792b09e77763c7441dfd4a15232cd90e2f21e3b75e7d5f2427ce8681d3f
- SSDEEP 1572864:SnZKXLUNLb8rP872FnPPxik3nBg591HVzKKspoInWgTNjOp4YQ2vA:MWLWv8+29PEkxUn1PspBbTNj+4Y0
- TLSH T121183343BC855199D69A9234C8A642623770B8588B3137D32F94EBF82F33BE55F36394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_c042d6ebb1a5b01bc6f202561334aa49_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_c042d6ebb1a5b01bc6f202561334aa49_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_c042d6ebb1a5b01bc6f202561334aa49_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver
- Size 87.5MB
- SHA256 1ad922bd4858460edcdd47621f7329df6327d778e2af804c93adf2afa2cdfa21
- MD5 c042d6ebb1a5b01bc6f202561334aa49
- SHA1 3646cd6bd340b9b6f3575eee8ccc295eb9989da7
- SHA512 2ebc7bf2a12f80bf8eaf83bae59ac94cd9c4933e47ed76a1d9c670b4cef4602402d7e792b09e77763c7441dfd4a15232cd90e2f21e3b75e7d5f2427ce8681d3f
- SSDEEP 1572864:SnZKXLUNLb8rP872FnPPxik3nBg591HVzKKspoInWgTNjOp4YQ2vA:MWLWv8+29PEkxUn1PspBbTNj+4Y0
- TLSH T121183343BC855199D69A9234C8A642623770B8588B3137D32F94EBF82F33BE55F36394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Suspicious use of NtSetInformationThreadHideFromDebugger