e4329c68ec4fee7c959843710c56ab2b3a8042dd4d0a5e1ecd7202f969da55be

General

Target
2026-07-02_c7b6bf81f340094375e1fbc9a6d97eb7_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
Size 3.1MB
Sample260702-m27fbagv7s
SHA256 e4329c68ec4fee7c959843710c56ab2b3a8042dd4d0a5e1ecd7202f969da55be
MD5 c7b6bf81f340094375e1fbc9a6d97eb7
SHA1 0637f46d4dd3890293a35d10fa1a93800cdc0b00
SHA512 5c241d66f6927293be3f13ec5839d62cdd3b52397499876b31d79cd9d5a38115abee5826b35b6184f34eff5b654e756ac1c93d0a9720a18d0cde1e56f55ffb3c
SSDEEP 49152:ZkZR34mGjfjragwfij4QtWbL54XNh4JJohkCctNypYFpBk5na6e:Zk/93fit3h4LP/OG
TLSH
T13FE58E077CE049F5D0AA533285A669A67B75BC858F3237C36E94F2792E32ED05E39301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-02_c7b6bf81f340094375e1fbc9a6d97eb7_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
- Size 3.1MB
- SHA256 e4329c68ec4fee7c959843710c56ab2b3a8042dd4d0a5e1ecd7202f969da55be
- MD5 c7b6bf81f340094375e1fbc9a6d97eb7
- SHA1 0637f46d4dd3890293a35d10fa1a93800cdc0b00
- SHA512 5c241d66f6927293be3f13ec5839d62cdd3b52397499876b31d79cd9d5a38115abee5826b35b6184f34eff5b654e756ac1c93d0a9720a18d0cde1e56f55ffb3c
- SSDEEP 49152:ZkZR34mGjfjragwfij4QtWbL54XNh4JJohkCctNypYFpBk5na6e:Zk/93fit3h4LP/OG
- TLSH
  T13FE58E077CE049F5D0AA533285A669A67B75BC858F3237C36E94F2792E32ED05E39301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer adware persistence ransomware
- Suspicious use of NtCreateProcessExOtherParentProcess
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2