591207ae5d63b6393edc870782021a7caa4b2ba167221364c021274bca058772

General

Target
2026-11-13_fe2ffffc02e86cfdddb59b2110dd1b01_cobalt-strike_frostygoop_glassworm_hive_icedid_luca-stealer_salatstealer_satacom_sliver
Size 3.4MB
Sample261113-xtargszz4n
SHA256 591207ae5d63b6393edc870782021a7caa4b2ba167221364c021274bca058772
MD5 fe2ffffc02e86cfdddb59b2110dd1b01
SHA1 54fcd4f391fdee5ab57883cd743afb5d97b372ab
SHA512 ee6e41739b931489de8969b98bae9425449e1d340e0c55fc52e6295e481b0f50a23fea72635401f8e3613485665daaf57f6a663383e520cf3f8b20f36c4ff0e3
SSDEEP 49152:0C5pRLlY4BarlStHkrB8vuDTHk4GalDCGj91aC:/vu4Uckriv/qaC
TLSH
T171F58C47BE9082B9C896E73689A21151B771BC4CC73233D76FA67A381E367C05E75B08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-11-13_fe2ffffc02e86cfdddb59b2110dd1b01_cobalt-strike_frostygoop_glassworm_hive_icedid_luca-stealer_salatstealer_satacom_sliver
- Size 3.4MB
- SHA256 591207ae5d63b6393edc870782021a7caa4b2ba167221364c021274bca058772
- MD5 fe2ffffc02e86cfdddb59b2110dd1b01
- SHA1 54fcd4f391fdee5ab57883cd743afb5d97b372ab
- SHA512 ee6e41739b931489de8969b98bae9425449e1d340e0c55fc52e6295e481b0f50a23fea72635401f8e3613485665daaf57f6a663383e520cf3f8b20f36c4ff0e3
- SSDEEP 49152:0C5pRLlY4BarlStHkrB8vuDTHk4GalDCGj91aC:/vu4Uckriv/qaC
- TLSH
  T171F58C47BE9082B9C896E73689A21151B771BC4CC73233D76FA67A381E367C05E75B08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware spyware stealer adware execution
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2