8f4ff8771cbe0f9b74929b0cff1f4f6a830abfb16e9101ee3d86e772ff19074d

General

Target
2026-05-29_dd3ad28906f3ef2525af9aa199d87a46_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch
Size 2.4MB
Sample260529-csk6lsbs7z
SHA256 8f4ff8771cbe0f9b74929b0cff1f4f6a830abfb16e9101ee3d86e772ff19074d
MD5 dd3ad28906f3ef2525af9aa199d87a46
SHA1 e145358f8cb973dff99bb16b848cce4ca608bae7
SHA512 18583acbd30df78c02dee14f4f3798c5aba7cf240b7d7a889970d01952964cc6fb15eca5e078e71c8c36fa725ed6cf54016fa57d00e73eaa97f620bfa8b74a98
SSDEEP 49152:ScHg3DrvXBLGCFMtZcT1CT8oJLz4VyW3AkXJAd:S9fptWZce8SvkZI
TLSH
T105C58D0A7CE008EAC46663328DA766927BB1FC450F76A7C72E50B2383FB26E45D75744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-29_dd3ad28906f3ef2525af9aa199d87a46_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch
- Size 2.4MB
- SHA256 8f4ff8771cbe0f9b74929b0cff1f4f6a830abfb16e9101ee3d86e772ff19074d
- MD5 dd3ad28906f3ef2525af9aa199d87a46
- SHA1 e145358f8cb973dff99bb16b848cce4ca608bae7
- SHA512 18583acbd30df78c02dee14f4f3798c5aba7cf240b7d7a889970d01952964cc6fb15eca5e078e71c8c36fa725ed6cf54016fa57d00e73eaa97f620bfa8b74a98
- SSDEEP 49152:ScHg3DrvXBLGCFMtZcT1CT8oJLz4VyW3AkXJAd:S9fptWZce8SvkZI
- TLSH
  T105C58D0A7CE008EAC46663328DA766927BB1FC450F76A7C72E50B2383FB26E45D75744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2