castlerat | 89ff4418a28e5c804ca2a4fb486f5dc67a17c6b3e97ae231566cfc313b809376

General

Target
2026-05-29_330cba96ef071d59cdd09088da35ebc9_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch
Size 4.6MB
Sample260529-thnbnags41
SHA256 89ff4418a28e5c804ca2a4fb486f5dc67a17c6b3e97ae231566cfc313b809376
MD5 330cba96ef071d59cdd09088da35ebc9
SHA1 a49005e1fa08797df9da61cd20592a212ca74f4b
SHA512 f1bc87b93c891671e8797028853d39103f0ecdb26e65e0a5e4957b5398642f21f381970e57b8045bba4fdd8071c64b79233a5a1009a22c9a6007f53be541cdc1
SSDEEP 49152:FSdlKaOk6UFAC0RHFCXGQNeFOpiRS5Xdv13wskQ:FAY02Q0MXTgskQ
TLSH
T1BA265B07BCA108E9C4A9A33989A356527B35B8491F3263D72E60B3B83F77BD05D79704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-29_330cba96ef071d59cdd09088da35ebc9_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch
- Size 4.6MB
- SHA256 89ff4418a28e5c804ca2a4fb486f5dc67a17c6b3e97ae231566cfc313b809376
- MD5 330cba96ef071d59cdd09088da35ebc9
- SHA1 a49005e1fa08797df9da61cd20592a212ca74f4b
- SHA512 f1bc87b93c891671e8797028853d39103f0ecdb26e65e0a5e4957b5398642f21f381970e57b8045bba4fdd8071c64b79233a5a1009a22c9a6007f53be541cdc1
- SSDEEP 49152:FSdlKaOk6UFAC0RHFCXGQNeFOpiRS5Xdv13wskQ:FAY02Q0MXTgskQ
- TLSH
  T1BA265B07BCA108E9C4A9A33989A356527B35B8491F3263D72E60B3B83F77BD05D79704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

tag_150 apt castlerat persistence spyware stealer trojan
- Detects C variant of CastleRAT.
  trojan apt tag_150
- Family: CastleRAT
  CastleRAT is a trojan available in both Python and C variants.
  trojan castlerat
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2