839d2c20bff9ee3edaaea668bbcf556b734d5f69a3edf94c08ecf67dd089b6fd

General

Target
2026-08-17_1b2b03a2f517f04d915d420735fd39c4_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
Size 2.6MB
Sample260817-ypfydaycmf
SHA256 839d2c20bff9ee3edaaea668bbcf556b734d5f69a3edf94c08ecf67dd089b6fd
MD5 1b2b03a2f517f04d915d420735fd39c4
SHA1 d486ea307cd3ac87baa0fd1353038d1792bc1481
SHA512 fdca8c4af562f95000fa34d7d3b9eeaafe6b21b7be8448ee86761cc4ff54f1b08ad01a317448b46f77aaf1705ddfff40cf5c5d4be5fe0c96be37a4c626fe0f17
SSDEEP 24576:g2uAEo/GMEROvMXxDqOtmXILfptI+fiqJRPx/lrJBeletr92s74SBY7nl2TRXATK:g2uDIG/OkX9qYmXEfp6/EPLxk7nlARJ
TLSH
T139D54A07BE9148E5D0AAE335C8A646557734BC0D8B3233E72E90BA782F727D19E35B44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-08-17_1b2b03a2f517f04d915d420735fd39c4_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
- Size 2.6MB
- SHA256 839d2c20bff9ee3edaaea668bbcf556b734d5f69a3edf94c08ecf67dd089b6fd
- MD5 1b2b03a2f517f04d915d420735fd39c4
- SHA1 d486ea307cd3ac87baa0fd1353038d1792bc1481
- SHA512 fdca8c4af562f95000fa34d7d3b9eeaafe6b21b7be8448ee86761cc4ff54f1b08ad01a317448b46f77aaf1705ddfff40cf5c5d4be5fe0c96be37a4c626fe0f17
- SSDEEP 24576:g2uAEo/GMEROvMXxDqOtmXILfptI+fiqJRPx/lrJBeletr92s74SBY7nl2TRXATK:g2uDIG/OkX9qYmXEfp6/EPLxk7nlARJ
- TLSH
  T139D54A07BE9148E5D0AAE335C8A646557734BC0D8B3233E72E90BA782F727D19E35B44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access discovery spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables referencing many Password Manager software clients. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2