Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 17:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_c2622c0ca3bcf7ba06f99f1cccb0112a_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_c2622c0ca3bcf7ba06f99f1cccb0112a_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-10_c2622c0ca3bcf7ba06f99f1cccb0112a_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
- Size 3.0MB
- Sample260710-vwpbjsfy5x
- SHA256 c49db3bacbfa2169601f1a8b7b2564020e0e00170d0d985d1103c6d7fc1ad8e2
- MD5 c2622c0ca3bcf7ba06f99f1cccb0112a
- SHA1 e29d3b4bba0f6e4a7fb00ea2b6d00f99f13e9ad3
- SHA512 6734210743d9d4930f4a05d8121a5a758970d8a4159f96e5589e7990cb8bc969e99bc870fd4b4f461accf456871eba19e35ec7c1ecc3d967e5c07c78e3ed97e5
- SSDEEP 49152:LrpMMFd6xm+xXl7uDtD8cA2uhTkoV+cCJUNEIp:LrfWtyA2eTHV+9ALp
- TLSH T1C9E58B07BCE04DFAC4A9A27189B345827BB2BC495F3227D32E90B6782E727D06D35754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 3 IoCs
resource yara_rule behavioral2/memory/3048-1-0x0000000360000000-0x0000000360228000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/3048-2-0x0000000360000000-0x0000000360228000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/3048-3-0x0000000360000000-0x0000000360228000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3048 2026-07-10_c2622c0ca3bcf7ba06f99f1cccb0112a_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3048 2026-07-10_c2622c0ca3bcf7ba06f99f1cccb0112a_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 3048 2026-07-10_c2622c0ca3bcf7ba06f99f1cccb0112a_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 3048 2026-07-10_c2622c0ca3bcf7ba06f99f1cccb0112a_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 3048 2026-07-10_c2622c0ca3bcf7ba06f99f1cccb0112a_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 3048 2026-07-10_c2622c0ca3bcf7ba06f99f1cccb0112a_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 3048 2026-07-10_c2622c0ca3bcf7ba06f99f1cccb0112a_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_c2622c0ca3bcf7ba06f99f1cccb0112a_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_c2622c0ca3bcf7ba06f99f1cccb0112a_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3048