c8230c1792d375a5bf9afbd0a490331e39127f581dc693dd8b03f511023e634e

General

Target
2026-08-03_5a8c9e7b4716bf69361a4ca88636d539_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
Size 4.0MB
Sample260804-nzne4avyex
SHA256 c8230c1792d375a5bf9afbd0a490331e39127f581dc693dd8b03f511023e634e
MD5 5a8c9e7b4716bf69361a4ca88636d539
SHA1 47064b16e9eaadcc6244290d4875afbd1e0cb039
SHA512 d97012f23e2ea309c6935be13ee4f8072af5034be5dc3d110160bab4aaf9443c722ff72fc147e688b6638924f63084ec3d3c32b8283383d80444bd345a4a726e
SSDEEP 49152:1dsWMXPshtItuXtp3NEv8aO0uCDEqxdXrn0OYgNsZrFu:1DMEPdqJNxpzbNsZo
TLSH
T184169C03BE9448FAC0DAE73584776696BA70B809073073E72E51BAB92F727D06E35744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-03_5a8c9e7b4716bf69361a4ca88636d539_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
- Size 4.0MB
- SHA256 c8230c1792d375a5bf9afbd0a490331e39127f581dc693dd8b03f511023e634e
- MD5 5a8c9e7b4716bf69361a4ca88636d539
- SHA1 47064b16e9eaadcc6244290d4875afbd1e0cb039
- SHA512 d97012f23e2ea309c6935be13ee4f8072af5034be5dc3d110160bab4aaf9443c722ff72fc147e688b6638924f63084ec3d3c32b8283383d80444bd345a4a726e
- SSDEEP 49152:1dsWMXPshtItuXtp3NEv8aO0uCDEqxdXrn0OYgNsZrFu:1DMEPdqJNxpzbNsZo
- TLSH
  T184169C03BE9448FAC0DAE73584776696BA70B809073073E72E51BAB92F727D06E35744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2