ca1f6dc7c75e8eff8d0f59526c63147567a45eb769e1c8a7d4c6e7778f2c0761

General

Target
2026-06-26_e73ac2f09111ff9050f9e4c7ad3bc616_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver
Size 3.4MB
Sample260629-nkpdvady3j
SHA256 ca1f6dc7c75e8eff8d0f59526c63147567a45eb769e1c8a7d4c6e7778f2c0761
MD5 e73ac2f09111ff9050f9e4c7ad3bc616
SHA1 13593f10c5ba9cee0a5b6eeebcc5ae5841c9a211
SHA512 5df38be8e3fade4a55d522348e7e824114e3ee3b9421be10612cd679620c44bd284a5d3166b92b79cd7c3b6524e1fe81289f9875c5aafd691bc26b10aa49ab94
SSDEEP 49152:LSF4jzUl0nSCp3eTQlW/uZS+JPmixhsyUmgzm2xvDYCcQpV7YCz+nvl7/PQn6:L9M5/j+JPmHf2
TLSH
T185F57A07BDA108E9C0AAD33588B7425A7A76BC480F3627E72E40B2B83F767D16D35754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-26_e73ac2f09111ff9050f9e4c7ad3bc616_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver
- Size 3.4MB
- SHA256 ca1f6dc7c75e8eff8d0f59526c63147567a45eb769e1c8a7d4c6e7778f2c0761
- MD5 e73ac2f09111ff9050f9e4c7ad3bc616
- SHA1 13593f10c5ba9cee0a5b6eeebcc5ae5841c9a211
- SHA512 5df38be8e3fade4a55d522348e7e824114e3ee3b9421be10612cd679620c44bd284a5d3166b92b79cd7c3b6524e1fe81289f9875c5aafd691bc26b10aa49ab94
- SSDEEP 49152:LSF4jzUl0nSCp3eTQlW/uZS+JPmixhsyUmgzm2xvDYCcQpV7YCz+nvl7/PQn6:L9M5/j+JPmHf2
- TLSH
  T185F57A07BDA108E9C0AAD33588B7425A7A76BC480F3627E72E40B2B83F767D16D35754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery spyware stealer credential_access
- Suspicious use of NtCreateProcessExOtherParentProcess
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2