castlerat | c25d942315b926dab7c1a3aff907891b0f3c7db6ff809d3399b6af6c4d389c67

General

Target
2026-05-29_113cca1e7a7a9e7ee88a9495a9080c6f_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch
Size 3.1MB
Sample260529-s3b9fshs8j
SHA256 c25d942315b926dab7c1a3aff907891b0f3c7db6ff809d3399b6af6c4d389c67
MD5 113cca1e7a7a9e7ee88a9495a9080c6f
SHA1 881b931f2a80604184934db7b4f68adb4f2cc506
SHA512 3271a8c0936043848a7a25fed10bbd14926962311975f4d4a1c095e201ff5a52deefa48aa243f6ba550c927e5f043124d7adac192c7b74dd8b1c6959f6125041
SSDEEP 24576:Sc54tasZwqCvsBI7aC/u/i5klxdtWh5ioUGm1Eg8MgMzOu5fLBele5ZK2hgLATB:Sc6taiwq9BIOaUi5klxdo+U6V8M97HF
TLSH
T114E57B16BCA009F6D49A63338DB762917BB5B8490F3223C72E50B6382F767D85C3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-29_113cca1e7a7a9e7ee88a9495a9080c6f_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch
- Size 3.1MB
- SHA256 c25d942315b926dab7c1a3aff907891b0f3c7db6ff809d3399b6af6c4d389c67
- MD5 113cca1e7a7a9e7ee88a9495a9080c6f
- SHA1 881b931f2a80604184934db7b4f68adb4f2cc506
- SHA512 3271a8c0936043848a7a25fed10bbd14926962311975f4d4a1c095e201ff5a52deefa48aa243f6ba550c927e5f043124d7adac192c7b74dd8b1c6959f6125041
- SSDEEP 24576:Sc54tasZwqCvsBI7aC/u/i5klxdtWh5ioUGm1Eg8MgMzOu5fLBele5ZK2hgLATB:Sc6taiwq9BIOaUi5klxdo+U6V8M97HF
- TLSH
  T114E57B16BCA009F6D49A63338DB762917BB5B8490F3223C72E50B6382F767D85C3A754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery tag_150 apt castlerat persistence spyware stealer trojan
- Detects C variant of CastleRAT.
  trojan apt tag_150
- Family: CastleRAT
  CastleRAT is a trojan available in both Python and C variants.
  trojan castlerat
- Custom signature
  
  Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2