Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 17:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_67f9b44552afc870b02ff7d8c99f7b4b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_67f9b44552afc870b02ff7d8c99f7b4b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-20_67f9b44552afc870b02ff7d8c99f7b4b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
- Size 88.2MB
- Sample260820-wccn3seh44
- SHA256 c20abf0cedfef5fe15bc92055729e99fd778ca65a7a482cdb24ec96002ff90b7
- MD5 67f9b44552afc870b02ff7d8c99f7b4b
- SHA1 a335268fc72c10883a7c72db8e51d63637691dd4
- SHA512 ca16ff9de71986321edd8d5363388f34aa73fd8b28c70f6da6e75a61a248f4d18adca8b7dd931f335d945fb278bce40b6bc6be8180459ffe0990b03dd49284ee
- SSDEEP 1572864:64hV69cypOv9ahMHt1Hpmjd4AW6fGbOi0BTXFVw1hAylRpk7LEok26e+qtS:LH69cypmEho1J0dBObOi0Bj8mopk7LED
- TLSH T1AF18330B7CB54469D067963E8AB20251B6B6B8445B3A73CB7F40F2743F35BC59A38B60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 19 IoCs
resource yara_rule behavioral2/memory/348-1-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-2-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-3-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-4-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-5-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-6-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-7-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-8-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-9-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-10-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-11-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-12-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-13-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-14-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-15-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-16-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-17-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-18-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/348-20-0x00000001B0000000-0x00000001B0260000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 348 2026-08-20_67f9b44552afc870b02ff7d8c99f7b4b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 348 2026-08-20_67f9b44552afc870b02ff7d8c99f7b4b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 348 2026-08-20_67f9b44552afc870b02ff7d8c99f7b4b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 348 2026-08-20_67f9b44552afc870b02ff7d8c99f7b4b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 348 2026-08-20_67f9b44552afc870b02ff7d8c99f7b4b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 348 2026-08-20_67f9b44552afc870b02ff7d8c99f7b4b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 348 2026-08-20_67f9b44552afc870b02ff7d8c99f7b4b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_67f9b44552afc870b02ff7d8c99f7b4b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_67f9b44552afc870b02ff7d8c99f7b4b_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:348