2026-10-01_3172c3da01a47faa97b89f0f5266a8a5_cobalt-strike_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver
Named malware families, obfuscation, evasion
Massive self-signed PE is mostly overlay paddingFile changed after it was signed
SHA-256841c15f9ac91c415ce77b7c3a0a4798c3e18a6f7a477409b65fe7c65c57174d8
Evidence
⋯3 more rows
0x5f000000000000000000000000000000000................
0x600ff20476f206275696c642049443a2022. Go build ID: "
0x610665738344f7452356e6d34626b534e44fW84OtR5nm4bkSND
0x62053544b472f33716a7630357347506642STKG/3qjv05sGPfB
0x630586e5773545442756d2f73717a624761XnWsTTBum/sqzbGa
0x64058634f59427330753274746378562f6fXcOYBs0u2ttcxV/o
0x650506f326f4d77745645484c7765797466Po2oMwtVEHLweytf
0x66071496b220a20ffccccccccccccccccccqIk". ..........
0x670cccccccccccccccccccccccccccccccc................
0x680493b661076384883ec1848896c241048I;f.v8H...H.l$.H
0x6908d6c2410488944242048895c24286690.l$.H.D$ H.\$(f.
0x6a0e89b050000488b442420488b5c2428e8.....H.D$ H.\$(.
0x6b02c000000488b6c24104883c418c34889,...H.l$.H....H.
0x6c044240848895c2410e8d3cd0500488b44D$.H.\$......H.D
0x6d02408488b5c2410eba7cccccccccccccc$.H.\$..........
0x6e04c8d6424f84d3b66100f862a05000048L.d$.M;f...*...H
0x6f081ec880000004889ac2480000000488d......H..$....H.
0x700ac24800000004889842490000000eb06.$....H..$......
0x7104889f04c89c34885db0f842e02000031H..L..H........1
0x720c9e9fa02000048c7c1ffffffff4885c9......H......H..
0x7307d0e4531c031f64889d9eb310f1f4000}.E1.1.H...1..@.
0x7404839d90f87c7040000488d71014839f3H9.......H.q.H9.
0x7500f82af0400004829cb488d7bff4989f8......H).H.{.I..
0x76048f7df48c1ff3f4821fe4801c64883f9H..H..?H!.H..H..
0x770047c9d81386370752e759531d20f1f00.|..8cpu.u.1....
0x780e9bb02000048c7c2ffffffff4c894424.....H......L.D$
0x7905048897424784885d20f8c5a01000090PH.t$xH....Z....
0x7a04839ca0f87490400004883fa040f8232H9...I...H.....2
0x7b0040000488d7afc4989f948f7df48c1ff...H.z.I..H..H..
0x7c03f83e704488d1c384c8d52014c39d10f?...H..8L.R.L9..
0x7d082070400004c894c244848895c246048.....L.L$HH.\$`H
0x7e029d14c8d59ff4c895c24204d89dc49f7).L.Y.L.\$ M..I.
0x7f0db49c1fb3f4d21da4e8d1c104c895c24.I..?M!.N...L.\$
0x800584883f9037519460fb71410664181faXH...u.F....fA..
0x8106f6e75784883f903eb29660f1f440000onuxH....)f..D..
0x8204883f9047566460fb72c10664181fd6fH...ufF..,.fA..o
0x830667559460fb65410024180fa66754d48fuYF..T..A..fuMH
0x84083f903410f94c24883fa077527440fb7...A...H...u'D..
0x8501c38664181fb616c751a0fb67c380290.8fA..alu...|8..
0x8604080ff6c750e488b3dab167c0031c0e9@..lu.H.=..|.1..
0x8701f030000448854241f488b1598167c00....D.T$.H....|.
0x30f319c0000004889442428488b052f057900....H.D$(H../.y.
0x30f41488d0d08527e004889042448894c2408H...R~.H..$H.L$.
0x30f51e80a190000450f57ff654c8b34252800.....E.W.eL.4%(.
0x30f6100004d8bb600000000488b44242831c9..M......H.D$(1.
0x30f71ba1e000000bb00ca9a3beb06488d51ff.........;..H.Q.
0x30f8189f94885d27c1a4863f089cf4889d148..H..|.Hc...H..H
0x30f91d3e64839f37ce54829f30fabcf6690eb..H9.|.H)....f..
0x30fa1db4863c04839c3b8ffffff7f0f4dc848.Hc.H9.......M.H
0x30fb163c14889058e517e00c605d34f7e0001c.H...Q~....O~..
0x30fc1488bac24880000004881c490000000c3H..$....H.......
0x30fd1488d05c4fd2200bb560000000f1f00e8H...."..V.......
0x30fe17b460000488d050bfd2200bb50000000{F..H...."..P...
0x30ff1e86a460000488d05cbac2200bb1b .jF..H...."...
0x236d80493b661076224883ec2048896c241848I;f.v"H.. H.l$.H
0x236d908d6c2418b929000000e862b2dcff488b.l$..)....b...H.
0x236da06c24184883c420c3488944240848895cl$.H.. .H.D$.H.\
0x236db02410e8e966e2ff488b442408488b5c24$...f..H.D$.H.\$
0x236dc010ebbd00000000000000000000000000................
0x236dd000000000000000000000000000000000................
0x236de000000000000000000000000000000000................
0x236df000000000000000000000000000000000................
0x236e00000001014201014601015200015f0001....B..F..R.._..
0x236e106300016600016700016800016b00016cc..f..g..h..k..l
0x236e2000016d00016e00016f00017000017300..m..n..o..p..s.
0x236e3001740001760001770001780001790002.t..v..w..x..y..
0x236e40696f00026f7300022e46010246640102io..os...F..Fd..
0x236e5048690102496e0102497301024c6f0102Hi..In..Is..Lo..
0x236e604f7001024f7201025043000262700002Op..Or..PC..bp..
0x236e7066640002666e00026730000267700002fd..fn..g0..gp..
0x236e806869000269640002696e000269730002hi..id..in..is..
0x236e906b7000026b7300026c6f00026c720002kp..ks..lo..lr..
0x236ea06d7500026e7800027063000270640002mu..nx..pc..pd..
0x236eb070700002707300027231000272320002pp..ps..r1..r2..
0x236ec07264000272670002726f000272740002rd..rg..ro..rt..
0x236ed073610002737000027373000274310002sa..sp..ss..t1..
0x236ee074320002746900027474000277640002t2..ti..tt..wd..
0x236ef0776700027772000277740003666d7401wg..wr..wt..fmt.
0x236f00034164640103416e6401034275660103.Add..And..Buf..
0x236f104361700103446c6c0103457272010347Cap..Dll..Err..G
0x236f2065740103496e7401034b657901034c65et..Int..Key..Le
0x236f306e01034d736701034e657701034e756dn..Msg..New..Num
0x236f4001034f75740103506164010350757401..Out..Pad..Put.
0x236f5003523136010352333201035365740103.R16..R32..Set..
0x236f60537472010353756d0103546167000361Str..Sum..Tag..a
0x236f7064640003617267000362616400036273dd..arg..bad..bs
0x236f8073000362756600036361730003646c6cs..buf..cas..dll
0x236f9000036473740003656e630003656e6400..dst..enc..end.
0x236fa003656f660003657272000366756e0003.eof..err..fun..
0x236fb0676377000367657400036b657900036cgcw..get..key..l
0x236fc0656e08036d4f5300036d617800036d69en..mOS..max..mi
0x236fd06e00036d736700036f626a00036f6666n..msg..obj..off
0x236fe000036f75740003706164000370637300..out..pad..pcs.
0x236ff003706664000370696e0003706f700003.pfd..pin..pop..
0x23700070747200037075740003717479000372ptr..put..qty..r
0x237010617700037265740003726f7000037273aw..ret..rop..rs
0x23702061000372756e00037365710003736574a..run..seq..set
0x23703000037369670003737464000373747200..sig..std..str.
0x237040037461670003746c730003746d700003.tag..tls..tmp..
0x237050747970000376616c0003776964000377typ..val..wid..w
0x2370606f7000046861736800046d61696e0004op..hash..main..
0x237070736f7274000473796e63000474696d65sort..sync..time
⋯10 more rows
0x7a817000000000000000000000000000000000................
0x7a8180300039000100410046000100610066000.9...A.F...a.f.
0x7a8190010010ff19ff010021ff26ff010041ff........!.&...A.
0x7a81a046ff0100000000000000000000000000F...............
0x7a81b000000000000000000000000000000000................
0x7a81c02d00ad0080008a0506187c1210201120-.........|.. .
0x7a81d00100172efb30e40263fe0dffaa0065ff.....0..c.....e.
0x7a81e065ff0100000000000000000000000000e...............
0x7a81f000000000000000000000000000000000................
0x7a8200400e440e0100c00ec40e0100b519b719@.D.............
0x7a82100100ba19b5aafb90b6aab9aa0300bbaa................
0x7a8220bcaa0100000000000000000000000000................
0x7a823000000000000000000000000000000000................
0x7a824030f1010049f101000100000050f101000...I.......P...
⋯4 more rows
0x7c45d000000000000000000000000000000000................
0x7c45e000000000000000000000000000000000................
0x7c45f000000000000000000000000000000000................
0x7c460000000000040000000000000001000803................
0x7c461003000000000011000000c36723000100...........g#...
⋯5 more rows