7656c5a7e2e2ed5d35752f6b82f28211fa932d87182a230103294f2467ecf27f

General

Target
2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
Size 2.8MB
Sample260703-ythb1abz2j
SHA256 7656c5a7e2e2ed5d35752f6b82f28211fa932d87182a230103294f2467ecf27f
MD5 a076e1b3240262f1e9d5453ae9a3d0be
SHA1 b0cf6ab8b66f67888c9f06b4fab912b734b304c5
SHA512 d449bbc17651cbebad5a4c6da0ecbfaf40d05c7c243541f92e5a9da2c5b8b5262662a8d5595b6784393d4a0e1a5b9f3f49ee33686c285367a428cc654a9f836a
SSDEEP 49152:uyC1qY7toEp6F61EkakFImy2rXMGbeYdYOL77aEG3eti6j2xgQx7yJL88jyTkign:uyzdUE5kFIzWMGbe2YOLftjti6ixgQRA
TLSH
T1EDD5AD0B7CD008E9C4AA533698BB51827B75BC094F3623D72E90B6382FB67D19D3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-03_a076e1b3240262f1e9d5453ae9a3d0be_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
- Size 2.8MB
- SHA256 7656c5a7e2e2ed5d35752f6b82f28211fa932d87182a230103294f2467ecf27f
- MD5 a076e1b3240262f1e9d5453ae9a3d0be
- SHA1 b0cf6ab8b66f67888c9f06b4fab912b734b304c5
- SHA512 d449bbc17651cbebad5a4c6da0ecbfaf40d05c7c243541f92e5a9da2c5b8b5262662a8d5595b6784393d4a0e1a5b9f3f49ee33686c285367a428cc654a9f836a
- SSDEEP 49152:uyC1qY7toEp6F61EkakFImy2rXMGbeYdYOL77aEG3eti6j2xgQx7yJL88jyTkign:uyzdUE5kFIzWMGbe2YOLftjti6ixgQRA
- TLSH
  T1EDD5AD0B7CD008E9C4AA533698BB51827B75BC094F3623D72E90B6382FB67D19D3A754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer adware persistence ransomware
- Suspicious use of NtCreateProcessExOtherParentProcess
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2