Analysis
- max time kernel
150s - max time network
15s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/09/2026, 10:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-21_bc65d9a28466ac0dae55df9fc546d49e_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-21_bc65d9a28466ac0dae55df9fc546d49e_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target 2026-09-21_bc65d9a28466ac0dae55df9fc546d49e_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
- Size 95.4MB
- Sample260922-mh1testdrc
- SHA256 d4a8a72aeb5bd61160d4a9686a95c008a33df7d81a1a7d1521a3b5c1feb9b11d
- MD5 bc65d9a28466ac0dae55df9fc546d49e
- SHA1 dfec951c1c8186d4b8bf42456adada800e07924f
- SHA512 7ea937f62d2c6b8d08ff6dd9e1800028b381ad76a7168fc289052e035ac9a92a099468bbf00eb23d6d3fab8bc5439fc17e60dc5310939fb7988a23411e1808f5
- SSDEEP 1572864:7KKziQOt/Bw356DZgn0Ws1E0RNUXbwl/UdcAheBfOh/HfnK52aMkAzpF1H:HiQWBwsDws19RNmwJUdcAUBmhfpaMdzB
- TLSH T1C628331B7B5581B8D196EA39D27692617731BC8CC73237D32E92EA742E313C69932F10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 4 IoCs
resource yara_rule behavioral2/memory/4524-0-0x0000000480000000-0x0000000480299000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4524-2-0x0000000480000000-0x0000000480299000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4524-3-0x0000000480000000-0x0000000480299000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4524-4-0x0000000480000000-0x0000000480299000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4524 2026-09-21_bc65d9a28466ac0dae55df9fc546d49e_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 4524 2026-09-21_bc65d9a28466ac0dae55df9fc546d49e_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 4524 2026-09-21_bc65d9a28466ac0dae55df9fc546d49e_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 4524 2026-09-21_bc65d9a28466ac0dae55df9fc546d49e_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 4524 2026-09-21_bc65d9a28466ac0dae55df9fc546d49e_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 4524 2026-09-21_bc65d9a28466ac0dae55df9fc546d49e_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-21_bc65d9a28466ac0dae55df9fc546d49e_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-21_bc65d9a28466ac0dae55df9fc546d49e_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4524