castlerat | 58eda486d34d649502ff6f451760ef1fb340c15ed808c226e9831e785d39dc04

General

Target
2026-05-29_19497d3d475f87768bb886681614c13c_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch
Size 2.0MB
Sample260529-s6cz6ahv4l
SHA256 58eda486d34d649502ff6f451760ef1fb340c15ed808c226e9831e785d39dc04
MD5 19497d3d475f87768bb886681614c13c
SHA1 714f05272917388564c680f8900928874566e845
SHA512 42370bb5506d5584159a62b39eb66100cd3c3993b43b49052a02b5b708bf133b9fc626211a914f0d07a62f2ca9722393fd984875393bfe429ecef1f8827837eb
SSDEEP 49152:T2+GjCMX1pdPBXcfPqRU0tb9OSgk0BCD1uX:7GpdPePmpUX
TLSH
T1F2A58C467CC060B6D5EA923288B512E17731FC990B3127C72B55BAB83E777E80E79394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-29_19497d3d475f87768bb886681614c13c_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch
- Size 2.0MB
- SHA256 58eda486d34d649502ff6f451760ef1fb340c15ed808c226e9831e785d39dc04
- MD5 19497d3d475f87768bb886681614c13c
- SHA1 714f05272917388564c680f8900928874566e845
- SHA512 42370bb5506d5584159a62b39eb66100cd3c3993b43b49052a02b5b708bf133b9fc626211a914f0d07a62f2ca9722393fd984875393bfe429ecef1f8827837eb
- SSDEEP 49152:T2+GjCMX1pdPBXcfPqRU0tb9OSgk0BCD1uX:7GpdPePmpUX
- TLSH
  T1F2A58C467CC060B6D5EA923288B512E17731FC990B3127C72B55BAB83E777E80E79394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

tag_150 apt castlerat persistence spyware stealer trojan discovery
- Detects C variant of CastleRAT.
  trojan apt tag_150
- Family: CastleRAT
  CastleRAT is a trojan available in both Python and C variants.
  trojan castlerat
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2