Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 08:12
General
- Target 2026-08-20_529c6ef7a1ee81f67302cad5dbd5c1fd_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
- Size 4.6MB
- Sample260820-j3xeyscb88
- SHA256 8a3d0e4d20896c34e257f5079b00fb5d02197233aef05420ca03c9dd4f9293a9
Malware Config
Extracted
-
cobaltstrike
-
http://129.211.13.156:44312/jquery-3.3.2.slim.min.js
-
user_agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_529c6ef7a1ee81f67302cad5dbd5c1fd_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_529c6ef7a1ee81f67302cad5dbd5c1fd_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3156-0-0x0000015C7CB10000-0x0000015C7CB11000-memory.dmp
memory/3156-5-0x0000015C7E760000-0x0000015C7E809000-memory.dmp
memory/3156-6-0x0000015C7EFB0000-0x0000015C7F3B0000-memory.dmp
memory/3156-4-0x0000015C7E760000-0x0000015C7E809000-memory.dmp
memory/3156-2-0x0000015C7E760000-0x0000015C7E809000-memory.dmp
memory/3156-1-0x0000015C7E760000-0x0000015C7E809000-memory.dmp
memory/3156-3-0x0000015C7E760000-0x0000015C7E809000-memory.dmp