General
- Target 2026-11-01_8169b4fffcab6a687433ac8d0b9d209e_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_glassworm_hijackloader_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver
- Size 10.5MB
- Sample261102-txqekabv3w
- SHA256 c83df21b9a5a856c2b065ebdb2abc14037425f78fad6381c74539513578f4cd2
- MD5 8169b4fffcab6a687433ac8d0b9d209e
- SHA1 332e07df053d5661067a15614ab27cfa41bbd3c9
- SHA512 e092af2f5fbcf9d54196787fb12e3b1da6e1db93b6055d0a2ee3bd35be468f49d69508884a28c79db72975dfac0c0d26517389a6741f908042f8b6ca585d7592
- SSDEEP 98304:eAuzUCGT9FOo3k2VxNyiHCSUtD/AWQnw6M+cTEUjmIphlaRwGp7U18dhwpDP:0I9bk2Vb/Utbl6fcAWzph+U18dhy
- TLSH T128B66B43FC5161E8C6E9C230CA76C25ABAB178C4473037D32B519AB62B63BD45A7937C
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_8169b4fffcab6a687433ac8d0b9d209e_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_8169b4fffcab6a687433ac8d0b9d209e_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-01_8169b4fffcab6a687433ac8d0b9d209e_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_glassworm_hijackloader_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver
- Size 10.5MB
- SHA256 c83df21b9a5a856c2b065ebdb2abc14037425f78fad6381c74539513578f4cd2
- MD5 8169b4fffcab6a687433ac8d0b9d209e
- SHA1 332e07df053d5661067a15614ab27cfa41bbd3c9
- SHA512 e092af2f5fbcf9d54196787fb12e3b1da6e1db93b6055d0a2ee3bd35be468f49d69508884a28c79db72975dfac0c0d26517389a6741f908042f8b6ca585d7592
- SSDEEP 98304:eAuzUCGT9FOo3k2VxNyiHCSUtD/AWQnw6M+cTEUjmIphlaRwGp7U18dhwpDP:0I9bk2Vb/Utbl6fcAWzph+U18dhy
- TLSH T128B66B43FC5161E8C6E9C230CA76C25ABAB178C4473037D32B519AB62B63BD45A7937C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects DarkSideRAT
-
Suspicious use of SetThreadContext