Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 04:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_564d86d4c794b0b7d48f7f92faf92e15_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_564d86d4c794b0b7d48f7f92faf92e15_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-22_564d86d4c794b0b7d48f7f92faf92e15_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
- Size 94.8MB
- Sample260822-ew76navxex
- SHA256 0b64b9666163f4c58cda7e43990266c788baa08ef9f215a1be9574326719153c
- MD5 564d86d4c794b0b7d48f7f92faf92e15
- SHA1 9f554c1a2086fd56e428586857a8d0300fb86788
- SHA512 e794c58860f8603fe2b3e9c5ab09d581f1b82ba1e999ea270e4a79bf426a20f8dbc0710ed4c89795eace7e63fa7230d61f7793ded34272bc746c0fdb29405702
- SSDEEP 1572864:8YumGAb/qOZWuQjLcPGTYdDpV8E4dP7wtOkZFetWk5veAU9RS4jAFX94:HYAbyLMdDpSlm4hIh9LjAt94
- TLSH T10928330378A941A5D4AADE34C47783137A61F88DCB3427935E61BA342FB97C35D7AB08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
resource yara_rule behavioral2/memory/3416-1-0x0000000460000000-0x000000046025A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/3416-4-0x0000000460000000-0x000000046025A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3416 2026-08-22_564d86d4c794b0b7d48f7f92faf92e15_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3416 2026-08-22_564d86d4c794b0b7d48f7f92faf92e15_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe 3416 2026-08-22_564d86d4c794b0b7d48f7f92faf92e15_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe 3416 2026-08-22_564d86d4c794b0b7d48f7f92faf92e15_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe 3416 2026-08-22_564d86d4c794b0b7d48f7f92faf92e15_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe 3416 2026-08-22_564d86d4c794b0b7d48f7f92faf92e15_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe 3416 2026-08-22_564d86d4c794b0b7d48f7f92faf92e15_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_564d86d4c794b0b7d48f7f92faf92e15_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_564d86d4c794b0b7d48f7f92faf92e15_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3416