Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 03:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-21_e4a7c6ffa9c66706e7e57cafd6568f44_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_e4a7c6ffa9c66706e7e57cafd6568f44_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-21_e4a7c6ffa9c66706e7e57cafd6568f44_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
- Size 91.0MB
- Sample260821-ec96xahe29
- SHA256 1cdc49a9c4f5a61d46d975b10a4033944de5b1191a1b602a871408049d01c1b7
- MD5 e4a7c6ffa9c66706e7e57cafd6568f44
- SHA1 3cd80f91c67ee6b342ce81df4ae48306e89f92cd
- SHA512 18ed48f97d6498d904afa06da81c2aa3f007a51290906322f8995c7be2b717930e304129da983fff63a61e007ee5d2c413f42dd8f2b50d5fc51c8287cb415bca
- SSDEEP 1572864:H5/5S92qgK9L9NUe1XJUiMmLpZHuEueshQzHTY5feE+ldvbRLy4PDjxJPn+C6XMA:ZDqgK9pNU6XVpZHuneIgTUmll9bRWGj+
- TLSH T14C283303BDA501A5C0ABA734C9B796427B75B8988B3273D72E50BB383E727C05E79744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
resource yara_rule behavioral2/memory/1108-1-0x0000000460000000-0x000000046025A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1108-4-0x0000000460000000-0x000000046025A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1108 2026-08-21_e4a7c6ffa9c66706e7e57cafd6568f44_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1108 2026-08-21_e4a7c6ffa9c66706e7e57cafd6568f44_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe 1108 2026-08-21_e4a7c6ffa9c66706e7e57cafd6568f44_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe 1108 2026-08-21_e4a7c6ffa9c66706e7e57cafd6568f44_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe 1108 2026-08-21_e4a7c6ffa9c66706e7e57cafd6568f44_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe 1108 2026-08-21_e4a7c6ffa9c66706e7e57cafd6568f44_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe 1108 2026-08-21_e4a7c6ffa9c66706e7e57cafd6568f44_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_e4a7c6ffa9c66706e7e57cafd6568f44_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_e4a7c6ffa9c66706e7e57cafd6568f44_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1108