castlerat | e0ad30d3587be86f17733492d4b774601356ff5b5e09c17f536704a4ced88f9e

General

Target
2026-05-29_1ed95a06c8079f7dcec191521083e622_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch
Size 3.1MB
Sample260529-s8elrshw4j
SHA256 e0ad30d3587be86f17733492d4b774601356ff5b5e09c17f536704a4ced88f9e
MD5 1ed95a06c8079f7dcec191521083e622
SHA1 4ebff376201bc71d09bc292c1846959ca5290e50
SHA512 7e2c4197ab6a6adbcdecf123b9b49df546a308711ce5c8721128e32adcf3e6b2601cb5477708bfbbb68e5218eb2b4bad0d3778b8602ffd7006b57df9dbaa35f8
SSDEEP 24576:G3JEhQPDxpQzt4ADvqoq88/4NbB4U35M3BLMbFeKfWOr8HdfLBele5ZK2hgTyTBB:G3GhQ7xyhrDk88/49uU35OIWm8tH3
TLSH
T175E56B26ACD045FAC4AA93338DB762917BB1BC480F3223C72E50B6782F766D49D39754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-29_1ed95a06c8079f7dcec191521083e622_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch
- Size 3.1MB
- SHA256 e0ad30d3587be86f17733492d4b774601356ff5b5e09c17f536704a4ced88f9e
- MD5 1ed95a06c8079f7dcec191521083e622
- SHA1 4ebff376201bc71d09bc292c1846959ca5290e50
- SHA512 7e2c4197ab6a6adbcdecf123b9b49df546a308711ce5c8721128e32adcf3e6b2601cb5477708bfbbb68e5218eb2b4bad0d3778b8602ffd7006b57df9dbaa35f8
- SSDEEP 24576:G3JEhQPDxpQzt4ADvqoq88/4NbB4U35M3BLMbFeKfWOr8HdfLBele5ZK2hgTyTBB:G3GhQ7xyhrDk88/49uU35OIWm8tH3
- TLSH
  T175E56B26ACD045FAC4AA93338DB762917BB1BC480F3223C72E50B6782F766D49D39754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

tag_150 apt castlerat persistence spyware stealer trojan
- Detects C variant of CastleRAT.
  trojan apt tag_150
- Family: CastleRAT
  CastleRAT is a trojan available in both Python and C variants.
  trojan castlerat
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2