e613b9a2f12e2fb758a99835f5d3b0e43f6dcc1e34b13e73ae201691a5da9151

General

Target
2026-05-30_b3751ed861ec8ff488eaa55af5587e7b_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch
Size 2.3MB
Sample260530-csa1msfv2m
SHA256 e613b9a2f12e2fb758a99835f5d3b0e43f6dcc1e34b13e73ae201691a5da9151
MD5 b3751ed861ec8ff488eaa55af5587e7b
SHA1 f48493f1a83e730d8ee2e74e64be606719292992
SHA512 2ecefe5adafd529e303ed45b8f169d754c9e6f7fe0f0eacb7c7048c71b9e44ab8d78400a797771456bf9674d29123207b09902a7f7cd73e22bdb02724ddbd7b4
SSDEEP 49152:afeKr3DqpAfUHZK9erQk6ZAeRCmhvXo7f:at8THSe0nN0ml4b
TLSH
T14CB57D177CE048FAC06A933288B25292BB75BC150F3223DB2E90B67D2F76AE45D35754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-30_b3751ed861ec8ff488eaa55af5587e7b_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch
- Size 2.3MB
- SHA256 e613b9a2f12e2fb758a99835f5d3b0e43f6dcc1e34b13e73ae201691a5da9151
- MD5 b3751ed861ec8ff488eaa55af5587e7b
- SHA1 f48493f1a83e730d8ee2e74e64be606719292992
- SHA512 2ecefe5adafd529e303ed45b8f169d754c9e6f7fe0f0eacb7c7048c71b9e44ab8d78400a797771456bf9674d29123207b09902a7f7cd73e22bdb02724ddbd7b4
- SSDEEP 49152:afeKr3DqpAfUHZK9erQk6ZAeRCmhvXo7f:at8THSe0nN0ml4b
- TLSH
  T14CB57D177CE048FAC06A933288B25292BB75BC150F3223DB2E90B67D2F76AE45D35754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2