Extracted

• • Target
    2026-08-23_3483f875b3dc3e5ff116659e39707455_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver
  • Size 2.0MB
  • SHA256 57d9ed21810cb157c16e9e626f7b22bca244014d4d0247d625317e4afc4202f1
  • MD5 3483f875b3dc3e5ff116659e39707455
  • SHA1 f223d5d6190651a8113cd876782bc589b2b2698b
  • SHA512 8b978646068d27bba4f08576d3e73cc9d2ee33d85a49c4c11098feadfe5bfc2c1a8d238249cc32e761f3319d093705cc718c20719be056261e8bc28fc1ddba41
  • SSDEEP 49152:pZau5V2ETTRLvjSlLmCf/BEO7xn0JzhWLqJ+gKVHt6Hz1:fnLUJERJ6N
  • TLSH
    T129A58C07BC91A4B9C4AAD2328A2692D176307C881B31A3D73B90B7FD2F767D41E79354
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutionpersistenceprivilege_escalationransomwarestealer

  • Renames multiple (9239) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2