Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/09/2026, 14:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-01_31f4986728b8c317d340f3d878a84f01_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-01_31f4986728b8c317d340f3d878a84f01_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-09-01_31f4986728b8c317d340f3d878a84f01_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
- Size 6.6MB
- Sample260903-rd2x5shr91
- SHA256 d4df270ea5a146713de213817b88ba95e575c2eea4c1e66f4c070cacc6ae1272
- MD5 31f4986728b8c317d340f3d878a84f01
- SHA1 aa8e1b114a17eb75221011ceae5c3293ba3dbcab
- SHA512 4fec0dad5e74b3c8f47335632ab99ef3955f48c516e4ba5759237b76f82fb6438157d079cfddecb0d10313e22f445a32a8f1d8b7a8acad97fb70d4b1d863eccb
- SSDEEP 49152:rj4JCr/RdwI/b9VaNqc1aiHRYGXcQLEPXgXIwr8q+MmLrRpyOWmV+CWt:rbpiHRXsiEYXJiLrR4pc6
- TLSH T1C3667C07BD6105E4C4AA8638C87B9343B779B88D4B3277D32E50BA382F797C499B6714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 4 IoCs
resource yara_rule behavioral2/memory/3428-1-0x0000000750000000-0x0000000750295000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/3428-2-0x0000000750000000-0x0000000750295000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/3428-3-0x0000000750000000-0x0000000750295000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/3428-4-0x0000000750000000-0x0000000750295000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3428 2026-09-01_31f4986728b8c317d340f3d878a84f01_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe 3428 2026-09-01_31f4986728b8c317d340f3d878a84f01_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe 3428 2026-09-01_31f4986728b8c317d340f3d878a84f01_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe 3428 2026-09-01_31f4986728b8c317d340f3d878a84f01_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe 3428 2026-09-01_31f4986728b8c317d340f3d878a84f01_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe 3428 2026-09-01_31f4986728b8c317d340f3d878a84f01_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe 3428 2026-09-01_31f4986728b8c317d340f3d878a84f01_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-01_31f4986728b8c317d340f3d878a84f01_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_31f4986728b8c317d340f3d878a84f01_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3428