General
- Target 2026-08-20_832bc71100d50132b58c0cecbf5dbeb4_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver
- Size 82.0MB
- Sample260820-xn36vatera
- SHA256 35f17f059ac12eb22fc138cb18f49c1031095aaa557d65821e0e2aedb3382d76
- MD5 832bc71100d50132b58c0cecbf5dbeb4
- SHA1 8166546429dd9cf90d9c865b5522aed7ea6ea68b
- SHA512 6b62bc0102ce7ca66f67a2b133f3137ebb089bf07dffc339afbfe6f8176b6b89f0c94e13647d8d47ced2fae912c01a4e84995993bc2531f0ea38b9407c2075e8
- SSDEEP 1572864:ZNuJl3TerEK3LOlFKPjMLWGUVrN6ZBg8R8rTxS+ewnzmqI+AbSR/ohG83hSGor:ruJ5A3SbKw6/dN6Z+8R8rg+fJI+O4yR8
- TLSH T107183343BC8059A4DAEAE63099A64251B7307C8C4B3037C33F50B6B53E76BE05E76B95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_832bc71100d50132b58c0cecbf5dbeb4_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_832bc71100d50132b58c0cecbf5dbeb4_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_832bc71100d50132b58c0cecbf5dbeb4_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver
- Size 82.0MB
- SHA256 35f17f059ac12eb22fc138cb18f49c1031095aaa557d65821e0e2aedb3382d76
- MD5 832bc71100d50132b58c0cecbf5dbeb4
- SHA1 8166546429dd9cf90d9c865b5522aed7ea6ea68b
- SHA512 6b62bc0102ce7ca66f67a2b133f3137ebb089bf07dffc339afbfe6f8176b6b89f0c94e13647d8d47ced2fae912c01a4e84995993bc2531f0ea38b9407c2075e8
- SSDEEP 1572864:ZNuJl3TerEK3LOlFKPjMLWGUVrN6ZBg8R8rTxS+ewnzmqI+AbSR/ohG83hSGor:ruJ5A3SbKw6/dN6Z+8R8rg+fJI+O4yR8
- TLSH T107183343BC8059A4DAEAE63099A64251B7307C8C4B3037C33F50B6B53E76BE05E76B95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Suspicious use of NtSetInformationThreadHideFromDebugger