hackbrowserdata | 2026-09-10_3f1c6c891bfd5838d1c253af0e6d47c7_cobalt-strike_coinminer_ghostlocker_glassworm_luca-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_3f1c6c891bfd5838d1c253af0e6d47c7_cobalt-strike_coinminer_ghostlocker_glassworm_luca-stealer
Size 21.2MB
Sample260910-wcllzstbmb
SHA256 f575d3d7cc87762edf67c8ebb159e9c0273df29c296d80100b7e74700843ea0d
MD5 3f1c6c891bfd5838d1c253af0e6d47c7
SHA1 0dfe8d00f4ad8a3ce12af7bc085309e5866728f8
SHA512 8b72e66746b5527a198a5c966e2df23b198bd4f9c0d3ff992ab6e155691785320f4e92d64a909230dbb9e1912d6721f3b4489e0eade151c26bf3a2e3813460ea
SSDEEP 98304:O3eizj2+fPVg9DLCC/uK+Q3UScTU2p0XloVsFFBqpDJ5NspfQDRLPliPTafuPj+q:G9uMaoC/uKbpRWrV0rqppmSlWurq
TLSH
T1C4274942B7894ADED6509A39CAAA13823370FC105F27E7D7AB45B23D3C726C59EB4701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

infostealer hackbrowserdata

Malware Config

Signatures

Family: HackBrowserData
An open source golang web browser extractor.
infostealer hackbrowserdata

An open source browser data exporter written in golang. 1 IoCs

resource	yara_rule
sample	family_hackbrowserdata

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-10_3f1c6c891bfd5838d1c253af0e6d47c7_cobalt-strike_coinminer_ghostlocker_glassworm_luca-stealer

File Explorer

2026-09-10_3f1c6c891bfd5838d1c253af0e6d47c7_cobalt-strike_coinminer_ghostlocker_glassworm_luca-stealer

.exe 21.2MB

2026-09-10_3f1c6c891bfd5838d1c253af0e6d47c7_cobalt-strike_coinminer_ghostlocker_glassworm_luca-stealer

IMPHASH 3e23e761a369bdbed5a449679e2294f3
SHA256 f575d3d7cc87762edf67c8ebb159e9c0273df29c296d80100b7e74700843ea0d
MD5 3f1c6c891bfd5838d1c253af0e6d47c7
SHA1 0dfe8d00f4ad8a3ce12af7bc085309e5866728f8
SHA512 8b72e66746b5527a198a5c966e2df23b198bd4f9c0d3ff992ab6e155691785320f4e92d64a909230dbb9e1912d6721f3b4489e0eade151c26bf3a2e3813460ea
SSDEEP 98304:O3eizj2+fPVg9DLCC/uK+Q3UScTU2p0XloVsFFBqpDJ5NspfQDRLPliPTafuPj+q:G9uMaoC/uKbpRWrV0rqppmSlWurq
TLSH
T1C4274942B7894ADED6509A39CAAA13823370FC105F27E7D7AB45B23D3C726C59EB4701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

An open source browser data exporter written in golang.
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler AreFileApisANSI CloseHandle CreateEventA CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateThread CreateWaitableTimerA CreateWaitableTimerExW DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetEnvironmentStringsW GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileSize GetFullPathNameA GetFullPathNameW GetLastError GetProcAddress GetProcessAffinityMask GetProcessHeap GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadContext GetTickCount GetVersionExA GetVersionExW HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MultiByteToWideChar OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus QueryPerformanceCounter ReadFile ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetEndOfFile SetErrorMode SetEvent SetFilePointer SetProcessPriorityBoost SetThreadContext SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsGetValue TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler

msvcrt

__getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _beginthread _beginthreadex _cexit _endthreadex _errno _fmode _initterm _localtime64 _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset qsort realloc signal strcmp strcspn strlen strncmp strrchr vfprintf

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

172KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

373KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

345B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

928B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

456KB

Virtual Size

456KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

5.8MB

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/106

Size

512B

Virtual Size

31B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_3f1c6c891bfd5838d1c253af0e6d47c7_cobalt-strike_coinminer_ghostlocker_glassworm_luca-stealer

kernel32

msvcrt

generic