87503fc4b208c49c41eda7a5b9a75d5699dbf3d8147b7831af376895cbe34b96

General

Target
2026-08-18_396c98ff61d5b3d4a8947a601e8d0771_frostygoop_ghostlocker_glassworm_hive_knight_luca-stealer_salatstealer_sliver
Size 88.0MB
Sample260818-hr6ntaxhrg
SHA256 87503fc4b208c49c41eda7a5b9a75d5699dbf3d8147b7831af376895cbe34b96
MD5 396c98ff61d5b3d4a8947a601e8d0771
SHA1 2c648bc3cefd249fcd81c7b600ea82948d959703
SHA512 2dc29a50a22e892715a864e0e9aa73686d56d30e6b555e29fc72e0aa732b1f0426c2279c0865ed630dbd9ac9f4fcc9ed38bfa3c255ff174f819e404036a27b03
SSDEEP 1572864:A/ROAzR58bUpEOUEmjeR2EsL2EnpWCfK1BkErHt6F8FSfJ7hymFYnnBw4H:Ajj8bUaOwjeYXlIP/rHtdPmFYnBw4H
TLSH
T127183303ADA405A9C49A9B39C5B393427778BC488B3137D72F51AA783F76BC16E79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-18_396c98ff61d5b3d4a8947a601e8d0771_frostygoop_ghostlocker_glassworm_hive_knight_luca-stealer_salatstealer_sliver
- Size 88.0MB
- SHA256 87503fc4b208c49c41eda7a5b9a75d5699dbf3d8147b7831af376895cbe34b96
- MD5 396c98ff61d5b3d4a8947a601e8d0771
- SHA1 2c648bc3cefd249fcd81c7b600ea82948d959703
- SHA512 2dc29a50a22e892715a864e0e9aa73686d56d30e6b555e29fc72e0aa732b1f0426c2279c0865ed630dbd9ac9f4fcc9ed38bfa3c255ff174f819e404036a27b03
- SSDEEP 1572864:A/ROAzR58bUpEOUEmjeR2EsL2EnpWCfK1BkErHt6F8FSfJ7hymFYnnBw4H:Ajj8bUaOwjeYXlIP/rHtdPmFYnBw4H
- TLSH
  T127183303ADA405A9C49A9B39C5B393427778BC488B3137D72F51AA783F76BC16E79700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Detects Windows executables referencing non-Windows User-Agents
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2