7a7e3dc2cae42ea923240c8749f4aa0183781cda0ec7627c5080b41d5d106435

General

Target
2026-08-03_86119a0b2ada8ffee505ff7bb97adc59_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
Size 4.1MB
Sample260804-m4t8rsdk7v
SHA256 7a7e3dc2cae42ea923240c8749f4aa0183781cda0ec7627c5080b41d5d106435
MD5 86119a0b2ada8ffee505ff7bb97adc59
SHA1 665dcf6d34f2567c78801c3661b6d676303a1bcc
SHA512 6089909d4e70c0bf0830ab4e3c1c2735897f6633ec60142286fad16708715e07b93688ebc4151aba51e24c6ed33de8ae99fe64e18b15223f9fde94752b0de5a2
SSDEEP 24576:D5SnvrN4amJoBIrSoPfDb8VQ5slZgvkY5EOl2SCf8GFIdqOitloJBeletr9DX7iL:D5SnD+tyIfjSQ5slyka10f8GxOiwpdE
TLSH
T1A5166B03BDA548F9D0D9E735C8675226BA70B8094B3173D32E61BAB92F367D09E38744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-08-03_86119a0b2ada8ffee505ff7bb97adc59_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
- Size 4.1MB
- SHA256 7a7e3dc2cae42ea923240c8749f4aa0183781cda0ec7627c5080b41d5d106435
- MD5 86119a0b2ada8ffee505ff7bb97adc59
- SHA1 665dcf6d34f2567c78801c3661b6d676303a1bcc
- SHA512 6089909d4e70c0bf0830ab4e3c1c2735897f6633ec60142286fad16708715e07b93688ebc4151aba51e24c6ed33de8ae99fe64e18b15223f9fde94752b0de5a2
- SSDEEP 24576:D5SnvrN4amJoBIrSoPfDb8VQ5slZgvkY5EOl2SCf8GFIdqOitloJBeletr9DX7iL:D5SnD+tyIfjSQ5slyka10f8GxOiwpdE
- TLSH
  T1A5166B03BDA548F9D0D9E735C8675226BA70B8094B3173D32E61BAB92F367D09E38744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access discovery spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables referencing many Password Manager software clients. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2