2fa8550bda360ebe07a6e6c003e646c95d1694cb0c056ca8338c663d01c36ea7

General

Target
2026-08-02_0010b08dacc7ebf3be5d9f1fd7210254_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
Size 4.2MB
Sample260802-149kcashkf
SHA256 2fa8550bda360ebe07a6e6c003e646c95d1694cb0c056ca8338c663d01c36ea7
MD5 0010b08dacc7ebf3be5d9f1fd7210254
SHA1 8bf0d7e0b5960abc532b33101e97fc8030699370
SHA512 decfd0136d03daaa33aeaeb39fbf900a4ffc90e564585622ee66976d7c68405cf544e9eb69cab31c1ed576b770eb2e087718377c7ae116f473ab85f4f97f4f53
SSDEEP 24576:xQoQs5eft2wUDBBlfdWgodOVL+q3tSpJsYDDmUYG/MqlkJBele5r9Ds7iNwuYI0K:xQDr12tBBVdWgodEvssYDDWG/MDm4fZ
TLSH
T17C166C03BD9548F9C1E9A73988A76226BB70B8088B3173D32E51BE752F763D09E35744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-08-02_0010b08dacc7ebf3be5d9f1fd7210254_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
- Size 4.2MB
- SHA256 2fa8550bda360ebe07a6e6c003e646c95d1694cb0c056ca8338c663d01c36ea7
- MD5 0010b08dacc7ebf3be5d9f1fd7210254
- SHA1 8bf0d7e0b5960abc532b33101e97fc8030699370
- SHA512 decfd0136d03daaa33aeaeb39fbf900a4ffc90e564585622ee66976d7c68405cf544e9eb69cab31c1ed576b770eb2e087718377c7ae116f473ab85f4f97f4f53
- SSDEEP 24576:xQoQs5eft2wUDBBlfdWgodOVL+q3tSpJsYDDmUYG/MqlkJBele5r9Ds7iNwuYI0K:xQDr12tBBVdWgodEvssYDDWG/MDm4fZ
- TLSH
  T17C166C03BD9548F9C1E9A73988A76226BB70B8088B3173D32E51BE752F763D09E35744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access discovery spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables referencing many Password Manager software clients. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2