General
- Target 2026-09-29_25bcd145865237e3e4117e0d8ef82498_cobalt-strike_frostygoop_ghostlocker_hive_luca-stealer_salatstealer_sliver_snatch
- Size 2.9MB
- Sample260930-espvxa1xft
- SHA256 bb2c6b5134842de9631cb770b8f6d5c668f9cef948f88a546ebec72f4fe6a41d
- MD5 25bcd145865237e3e4117e0d8ef82498
- SHA1 d1b6df51c8a109138b827a84b598753b3103d07b
- SHA512 6f63448a5c70bbea7cee3018d0d7c3409bca5f44a7fc78c0a6fe828b52e64169e0d149e1604c2e47e5e946fc1a0b12cdff55048f77e8fce613441e41e2db242c
- SSDEEP 49152:l6xME2f5y9KCOi5+Crg5oz/zQIM72D1EVD1SjR9N5O6X/5NIoQDhX:eyC7De3R2Ta6Pgz
- TLSH T1FCE58D47FC61F5A4CADA91318864819676327C480F7167DB6B00ABBA2F7B7C01F793A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_25bcd145865237e3e4117e0d8ef82498_cobalt-strike_frostygoop_ghostlocker_hive_luca-stealer_s.exe
Resource
win10v2004-20260911-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_25bcd145865237e3e4117e0d8ef82498_cobalt-strike_frostygoop_ghostlocker_hive_luca-stealer_s.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
Malware Config
Extracted
Family
-
cobaltstrike
C2
-
http://1.14.192.93:443/Rpc
Attributes
-
user_agent
Host: outlook.live.com Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko)
Targets
-
- Target 2026-09-29_25bcd145865237e3e4117e0d8ef82498_cobalt-strike_frostygoop_ghostlocker_hive_luca-stealer_salatstealer_sliver_snatch
- Size 2.9MB
- SHA256 bb2c6b5134842de9631cb770b8f6d5c668f9cef948f88a546ebec72f4fe6a41d
- MD5 25bcd145865237e3e4117e0d8ef82498
- SHA1 d1b6df51c8a109138b827a84b598753b3103d07b
- SHA512 6f63448a5c70bbea7cee3018d0d7c3409bca5f44a7fc78c0a6fe828b52e64169e0d149e1604c2e47e5e946fc1a0b12cdff55048f77e8fce613441e41e2db242c
- SSDEEP 49152:l6xME2f5y9KCOi5+Crg5oz/zQIM72D1EVD1SjR9N5O6X/5NIoQDhX:eyC7De3R2Ta6Pgz
- TLSH T1FCE58D47FC61F5A4CADA91318864819676327C480F7167DB6B00ABBA2F7B7C01F793A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.