Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 03:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_2fc660d696774682ba480b4791f0bf5b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_2fc660d696774682ba480b4791f0bf5b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-17_2fc660d696774682ba480b4791f0bf5b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
- Size 91.1MB
- Sample260817-d8b4bas1at
- SHA256 081194ad94e8aa01fd713abdfcd2afcd9a075b6d9ce6ee3a412b02d6dee7644e
- MD5 2fc660d696774682ba480b4791f0bf5b
- SHA1 41524e918ff412a90e76c6919f80065220ec6d7d
- SHA512 6366fb89693b0b777654057544a677145b23b639001bf2f05883533b04c8ec2df106144b448332ad032b9917f9d8ca9616a65e7d156456d7ea3816fa5f98d930
- SSDEEP 1572864:c+nEi4Rct36VnVDLXplNd8wP9tfqingXjMsCn8r2OEA8d2bPHGl:5Ei4Kyp9TriLO85EA8MPml
- TLSH T1D5283307BCA600B9D4A5973989720958B6B0F8088F3A73D77E40F2757F71BD44A38BA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
resource yara_rule behavioral2/memory/3420-1-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/3420-4-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3420 2026-08-17_2fc660d696774682ba480b4791f0bf5b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3420 2026-08-17_2fc660d696774682ba480b4791f0bf5b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 3420 2026-08-17_2fc660d696774682ba480b4791f0bf5b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 3420 2026-08-17_2fc660d696774682ba480b4791f0bf5b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 3420 2026-08-17_2fc660d696774682ba480b4791f0bf5b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 3420 2026-08-17_2fc660d696774682ba480b4791f0bf5b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 3420 2026-08-17_2fc660d696774682ba480b4791f0bf5b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_2fc660d696774682ba480b4791f0bf5b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_2fc660d696774682ba480b4791f0bf5b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3420