c66ab686abe807cca0944a899b5bf88065250f5bea464529a1fad0d2c19fdfe6

General

Target
2026-07-09_7afb356c100e97d9aedcf55a54594958_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
Size 2.8MB
Sample260709-vncb1se12v
SHA256 c66ab686abe807cca0944a899b5bf88065250f5bea464529a1fad0d2c19fdfe6
MD5 7afb356c100e97d9aedcf55a54594958
SHA1 94548090e39cf92ee920627297c6d8bf7fab4906
SHA512 cf6d0e9de0dc6c10de737eb3b203fd53de95bd8e46b4f5beac4072c5537bb5ca34a12af04bf17bebc4f0417f2124b672f7662eb3187b9253e97421c4db2094bb
SSDEEP 49152:CP+TvUKpDX2gSSPB4qcv4A8UAGxgzqKVhZBI4xzNbl:CP/SPX1xJl
TLSH
T1D6D5AE4BACD009E5C8A9633589B792927B70FC194B3267C32E90B7793F726D19D3A740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-07-09_7afb356c100e97d9aedcf55a54594958_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
- Size 2.8MB
- SHA256 c66ab686abe807cca0944a899b5bf88065250f5bea464529a1fad0d2c19fdfe6
- MD5 7afb356c100e97d9aedcf55a54594958
- SHA1 94548090e39cf92ee920627297c6d8bf7fab4906
- SHA512 cf6d0e9de0dc6c10de737eb3b203fd53de95bd8e46b4f5beac4072c5537bb5ca34a12af04bf17bebc4f0417f2124b672f7662eb3187b9253e97421c4db2094bb
- SSDEEP 49152:CP+TvUKpDX2gSSPB4qcv4A8UAGxgzqKVhZBI4xzNbl:CP/SPX1xJl
- TLSH
  T1D6D5AE4BACD009E5C8A9633589B792927B70FC194B3267C32E90B7793F726D19D3A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access discovery spyware stealer adware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2