General
- Target 2026-08-23_5b011d934d815f33e868c4682d913bca_cobalt-strike_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch
- Size 9.2MB
- Sample260824-m7kthawgpb
- SHA256 9441a243e24f3b7b0ac877f538b6c1be4e37672c87e6e0f7859f0ac1db53ef36
- MD5 5b011d934d815f33e868c4682d913bca
- SHA1 24ab187333aac749c93e28d107911d37133a0907
- SHA512 b67dbce8f793249b6f041be40fc726569d744fc30c50bc052e6b772d76fb771d0dd413a19aec1cc4ef67bcd691b23871e49d483e9d76f693a307e6a675d404cc
- SSDEEP 98304:5okMjZ7XsdJCljGOnezDlmKDDEn5fA9lf1F2tWxa:yrVXsd7lmKK9of1FZa
- TLSH T160A63B51F9DB44F2DA0314300877926F17386E098B29CBDBDA147F6AED77AE10A73219
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-23_5b011d934d815f33e868c4682d913bca_cobalt-strike_coinminer_elex_frostygoop_glassworm_hive_p.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Malware Config
Extracted
Family
-
lumma
C2
-
https://impend-differ.biz/api
-
https://print-vexer.biz/api
-
https://dare-curbys.biz/api
-
https://covery-mover.biz/api
-
https://formy-spill.biz/api
-
https://dwell-exclaim.biz/api
-
https://zinc-sneark.biz/api
-
https://se-blurry.biz/api
Targets
-
- Target 2026-08-23_5b011d934d815f33e868c4682d913bca_cobalt-strike_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch
- Size 9.2MB
- SHA256 9441a243e24f3b7b0ac877f538b6c1be4e37672c87e6e0f7859f0ac1db53ef36
- MD5 5b011d934d815f33e868c4682d913bca
- SHA1 24ab187333aac749c93e28d107911d37133a0907
- SHA512 b67dbce8f793249b6f041be40fc726569d744fc30c50bc052e6b772d76fb771d0dd413a19aec1cc4ef67bcd691b23871e49d483e9d76f693a307e6a675d404cc
- SSDEEP 98304:5okMjZ7XsdJCljGOnezDlmKDDEn5fA9lf1F2tWxa:yrVXsd7lmKK9of1FZa
- TLSH T160A63B51F9DB44F2DA0314300877926F17386E098B29CBDBDA147F6AED77AE10A73219
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Suspicious use of SetThreadContext