Analysis
- max time kernel
150s - max time network
16s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 02:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_0661dc64986710318c485035b60c7a79_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_0661dc64986710318c485035b60c7a79_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-20_0661dc64986710318c485035b60c7a79_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
- Size 87.6MB
- Sample260820-czyqaadn91
- SHA256 38b155088a7476e96fb11ce77a0fc1a295139da19c21d1136f5a27f0af6ddcff
- MD5 0661dc64986710318c485035b60c7a79
- SHA1 33a33babcc5f5c0e92db2044e82ae07a39fb7ea7
- SHA512 5b27e144f34a2bf7fa0e6bc91d6911aff1c14876bb10387250d1caad885f1e0dc691d08f9b71f876279ba875d4ef3f0e29ec275366b40c39fc1f09563998cff0
- SSDEEP 1572864:+2DrUtl4hDELmTRpHv+jObQTlIT3nzF5VDMqE7gbgQIttgDyu274oijdfI6h2+:+Cu4+2PHm6s5o3np/oMHyv74oijdIC2+
- TLSH T146183317BB5591E0C897DA3A96BA43406B397C1E873473E73E28BA341F367D02A71B14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
resource yara_rule behavioral2/memory/3328-1-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/3328-4-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3328 2026-08-20_0661dc64986710318c485035b60c7a79_frostygoop_hive_luca-stealer_salatstealer_sliver.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3328 2026-08-20_0661dc64986710318c485035b60c7a79_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 3328 2026-08-20_0661dc64986710318c485035b60c7a79_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 3328 2026-08-20_0661dc64986710318c485035b60c7a79_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 3328 2026-08-20_0661dc64986710318c485035b60c7a79_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 3328 2026-08-20_0661dc64986710318c485035b60c7a79_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 3328 2026-08-20_0661dc64986710318c485035b60c7a79_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_0661dc64986710318c485035b60c7a79_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_0661dc64986710318c485035b60c7a79_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3328