8acb1c2bb6786c44f9d57841aa61a6aa4d58dbcb66304b8f0180784af3f6f453

General

Target
2026-08-18_fae372beb324d31e9a6edc8f8468ce46_frostygoop_ghostlocker_glassworm_hive_knight_luca-stealer_salatstealer_sliver
Size 89.0MB
Sample260818-fa6ldaw1cs
SHA256 8acb1c2bb6786c44f9d57841aa61a6aa4d58dbcb66304b8f0180784af3f6f453
MD5 fae372beb324d31e9a6edc8f8468ce46
SHA1 ba96321d03baeb3aeda9edfb953ea47aeb67732e
SHA512 99d78f9c0775118232a8b756438e899a9e16cd05d34a81cde158a71b72fbc407a70bdfc0920daba98e3f6a52c1b813114ff841d82366aedd81fb0d8cef6caf7f
SSDEEP 1572864:Ake3K4GGftwgE8Pyn8PqF5fmreVzblaz4UEaOcE+t+0/L:APK4Hftw98Pyne0VblaocE+t+0D
TLSH
T1E8283303BDA504A9C49AAA39C9B793527778B8488B3133D72F51E6383F76BC16D78740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-18_fae372beb324d31e9a6edc8f8468ce46_frostygoop_ghostlocker_glassworm_hive_knight_luca-stealer_salatstealer_sliver
- Size 89.0MB
- SHA256 8acb1c2bb6786c44f9d57841aa61a6aa4d58dbcb66304b8f0180784af3f6f453
- MD5 fae372beb324d31e9a6edc8f8468ce46
- SHA1 ba96321d03baeb3aeda9edfb953ea47aeb67732e
- SHA512 99d78f9c0775118232a8b756438e899a9e16cd05d34a81cde158a71b72fbc407a70bdfc0920daba98e3f6a52c1b813114ff841d82366aedd81fb0d8cef6caf7f
- SSDEEP 1572864:Ake3K4GGftwgE8Pyn8PqF5fmreVzblaz4UEaOcE+t+0/L:APK4Hftw98Pyne0VblaocE+t+0D
- TLSH
  T1E8283303BDA504A9C49AAA39C9B793527778B8488B3133D72F51E6383F76BC16D78740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Detects Windows executables referencing non-Windows User-Agents
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2