Behavioral task
behavioral1
Sample
2025-03-23_8a0a10c809b923692e630dcc5f54d670_frostygoop_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-23_8a0a10c809b923692e630dcc5f54d670_frostygoop_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
Resource
win10v2004-20250313-en
General
-
Target
2025-03-23_8a0a10c809b923692e630dcc5f54d670_frostygoop_luca-stealer_ngrbot_poet-rat_sliver_snatch
-
Size
10.0MB
-
MD5
8a0a10c809b923692e630dcc5f54d670
-
SHA1
3327cd5599ddd6c6e9ca34d6b49a8ff82be48f73
-
SHA256
33cfd709e8f616bb5d57a68d63f0eda2b58df62075692236c3c02438eb49fb87
-
SHA512
0a9c57b6e5baf6b249f93375c31dd9a69d328ef40d336295f90a61d084bcc639253bc9335b3afb847e0cd00b93bfc84302fbebabb1efb726ff397ade1839b8c4
-
SSDEEP
98304:T5IFEwQ/P6tD87AaN1GKJt/YCTJvMAWwaA9rsDE:TAEw6P6+1GKJBjTBMAWwtOQ
Malware Config
Signatures
-
Skuld family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-03-23_8a0a10c809b923692e630dcc5f54d670_frostygoop_luca-stealer_ngrbot_poet-rat_sliver_snatch
Files
-
2025-03-23_8a0a10c809b923692e630dcc5f54d670_frostygoop_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 555KB - Virtual size: 917KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 114KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.symtab Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ