General
- Target 2026-08-20_965e9dd10f2bd190958e319633004876_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver
- Size 88.0MB
- Sample260820-xmje2stepg
- SHA256 faedc0417009dad91907d2c01435315bbc0251d287ff6863562df01c7c6a7b4f
- MD5 965e9dd10f2bd190958e319633004876
- SHA1 d277b304cef20ca3462ad0dc12003f4959914cec
- SHA512 6b8846f40a8d550173f9539996f1ac0ef9b6afc38b933a5e2ce07b87fff4c8d44675471b5332302b15163fef657a0c49d5ebf40fd6a38c631ba126a5aff15354
- SSDEEP 1572864:ZczNP4MuCA/98jkDuDCkYnC0G2SACaoJszL1mtJrJ6m+gTMjy1mF:KGMxU/kYGYC/JY6JFwjycF
- TLSH T1BD183307BED005A5D1EAE2318DA60255B630BC9D4B3137C32F50B6B12E77BE59E39B81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_965e9dd10f2bd190958e319633004876_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_965e9dd10f2bd190958e319633004876_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_965e9dd10f2bd190958e319633004876_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver
- Size 88.0MB
- SHA256 faedc0417009dad91907d2c01435315bbc0251d287ff6863562df01c7c6a7b4f
- MD5 965e9dd10f2bd190958e319633004876
- SHA1 d277b304cef20ca3462ad0dc12003f4959914cec
- SHA512 6b8846f40a8d550173f9539996f1ac0ef9b6afc38b933a5e2ce07b87fff4c8d44675471b5332302b15163fef657a0c49d5ebf40fd6a38c631ba126a5aff15354
- SSDEEP 1572864:ZczNP4MuCA/98jkDuDCkYnC0G2SACaoJszL1mtJrJ6m+gTMjy1mF:KGMxU/kYGYC/JY6JFwjycF
- TLSH T1BD183307BED005A5D1EAE2318DA60255B630BC9D4B3137C32F50B6B12E77BE59E39B81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Suspicious use of NtSetInformationThreadHideFromDebugger