General
- Target 2026-07-09_edb475d5d749cf45c7ae4a9cf262f902_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver
- Size 2.8MB
- Sample260709-b6bzesct7v
- SHA256 3f5f48b17b74e21aee25caec810d337d94da2a726b18e3b763b5f3f233c69dde
- MD5 edb475d5d749cf45c7ae4a9cf262f902
- SHA1 6f91fcf7d9834ab4fa3c8ce258c0f1297a0b56f4
- SHA512 576ca49a2faf77a930884a0cbdc1987805ebbc092cb8965be2859aefc9247a8737aaddc9883e84c74161bc3a7b114fb2a1da1b3e42bcc853fa9542ea085d9f66
- SSDEEP 24576:UPuoEHs5inPdHdw+qkMlfaYNNtkySORwBeleX7KDIkpaIt+/1rJTt/pgaeQ/Ub4a:UPuTM5QH+kyfxvY78sPMla24CMQz1
- TLSH T168D55B0BBCD108EAC4AAA23289B652927B75BC490F3223D72E50B3793F767E05D75744
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-09_edb475d5d749cf45c7ae4a9cf262f902_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-09_edb475d5d749cf45c7ae4a9cf262f902_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe
Resource
win11ltsc2024-20260706-en
Malware Config
Targets
-
- Target 2026-07-09_edb475d5d749cf45c7ae4a9cf262f902_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver
- Size 2.8MB
- SHA256 3f5f48b17b74e21aee25caec810d337d94da2a726b18e3b763b5f3f233c69dde
- MD5 edb475d5d749cf45c7ae4a9cf262f902
- SHA1 6f91fcf7d9834ab4fa3c8ce258c0f1297a0b56f4
- SHA512 576ca49a2faf77a930884a0cbdc1987805ebbc092cb8965be2859aefc9247a8737aaddc9883e84c74161bc3a7b114fb2a1da1b3e42bcc853fa9542ea085d9f66
- SSDEEP 24576:UPuoEHs5inPdHdw+qkMlfaYNNtkySORwBeleX7KDIkpaIt+/1rJTt/pgaeQ/Ub4a:UPuTM5QH+kyfxvY78sPMla24CMQz1
- TLSH T168D55B0BBCD108EAC4AAA23289B652927B75BC490F3223D72E50B3793F767E05D75744
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2