b085871c02152af2c3446f728cb4c255e668adcd83dad61f4460580afeb36a90

General

Target
2026-07-01_01c384de4a1cf8071a4938b0785862c2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
Size 3.1MB
Sample260701-myyc8set7s
SHA256 b085871c02152af2c3446f728cb4c255e668adcd83dad61f4460580afeb36a90
MD5 01c384de4a1cf8071a4938b0785862c2
SHA1 f9cd5e8d3524ec15de0436e5376d9921e2d51e9d
SHA512 cbba0ef6a966bbddd13d84ff6c0a5051cb3c8b52675a4d5d0327819cc3441166ae7cec9be26b56705293fcef4ba225221694035cf5940ad5870d72ccff0e7712
SSDEEP 49152:dcv2k6aQX44Y1VPN7Yb85IJb0Zh3jK4s6l2FAv4nl6o:dceCPPDDe4JQr3
TLSH
T1BAE57D07BCA089E9D499533289AA56867B75BC150B3233C76EA273383F36BD07D39714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-01_01c384de4a1cf8071a4938b0785862c2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
- Size 3.1MB
- SHA256 b085871c02152af2c3446f728cb4c255e668adcd83dad61f4460580afeb36a90
- MD5 01c384de4a1cf8071a4938b0785862c2
- SHA1 f9cd5e8d3524ec15de0436e5376d9921e2d51e9d
- SHA512 cbba0ef6a966bbddd13d84ff6c0a5051cb3c8b52675a4d5d0327819cc3441166ae7cec9be26b56705293fcef4ba225221694035cf5940ad5870d72ccff0e7712
- SSDEEP 49152:dcv2k6aQX44Y1VPN7Yb85IJb0Zh3jK4s6l2FAv4nl6o:dceCPPDDe4JQr3
- TLSH
  T1BAE57D07BCA089E9D499533289AA56867B75BC150B3233C76EA273383F36BD07D39714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer adware persistence ransomware
- Suspicious use of NtCreateProcessExOtherParentProcess
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2