20985bda95e390d40ff6a2b968998ac9e13d20497ef17c087cb59828f18383bb

General

Target
2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
Size 4.1MB
Sample260804-llsfsawhrc
SHA256 20985bda95e390d40ff6a2b968998ac9e13d20497ef17c087cb59828f18383bb
MD5 ce836c60e36f69b282bf5856bb4d22e2
SHA1 a5bc171af4ddda8664e254532f9a5d918282e26d
SHA512 62fc031d1f2c1f75a18f5082e7fb6a9feb241ec10792c8becc47c2818ad6881b3b2741175086d7ec6049da5a2c372da300536bab3db8d98706fb37ddc1f3b2eb
SSDEEP 49152:mjDt+LNAG0ZGpYdavq8lfWK8RfXJdIvEzzQD22D0m2/:mVNPeWK8pPIvGzQD2fb
TLSH
T1C616AE03A95548FAC1E9D73984B262267A74B80D4B3073D72E22BFB92F763D05E39744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-03_ce836c60e36f69b282bf5856bb4d22e2_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
- Size 4.1MB
- SHA256 20985bda95e390d40ff6a2b968998ac9e13d20497ef17c087cb59828f18383bb
- MD5 ce836c60e36f69b282bf5856bb4d22e2
- SHA1 a5bc171af4ddda8664e254532f9a5d918282e26d
- SHA512 62fc031d1f2c1f75a18f5082e7fb6a9feb241ec10792c8becc47c2818ad6881b3b2741175086d7ec6049da5a2c372da300536bab3db8d98706fb37ddc1f3b2eb
- SSDEEP 49152:mjDt+LNAG0ZGpYdavq8lfWK8RfXJdIvEzzQD22D0m2/:mVNPeWK8pPIvGzQD2fb
- TLSH
  T1C616AE03A95548FAC1E9D73984B262267A74B80D4B3073D72E22BFB92F763D05E39744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2