General
- Target 2026-10-26_7f555dea7f731c6f1caab54219ef33b7_frostygoop_hive_luca-stealer_salatstealer_sliver
- Size 7.7MB
- Sample261027-qp7gbsdf66
- SHA256 6ff0ef9620719cc11521c22b17eea4f7e5410ecfd67d60714e6e5bc0f13dd678
- MD5 7f555dea7f731c6f1caab54219ef33b7
- SHA1 96c12a3acab6512a40c698588a2f2fd5dc962c5b
- SHA512 65c17f6deebc25ba6c7b299b152213277beb1d8a8e5485a671e9953914d96000a51751a4afb53f8081db2996eb14149591ae78e2a02f0411d437d801ee5b2bc3
- SSDEEP 49152:Ph517DFYLfhiSJJv2L5A2sJ5ccW9Jn46WuA35ELX6a7W69MddiUD2pCxV6+gamRg:gHO
- TLSH T14E865E037B4800D8C867EEB080B54A7951B03DDD9631BA5B8DE97EA41F1A3996FEDF01
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_7f555dea7f731c6f1caab54219ef33b7_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-26_7f555dea7f731c6f1caab54219ef33b7_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
Malware Config
Extracted
Family
-
remus_stealer
Botnet
-
0f81469cc7638ba7c82eaddbd6b3c20a
C2
-
http://sparlink.click:7528/transactions
-
http://prility.top:9932/profiles
-
http://visnary.my:5621/subscriptions
Targets
-
- Target 2026-10-26_7f555dea7f731c6f1caab54219ef33b7_frostygoop_hive_luca-stealer_salatstealer_sliver
- Size 7.7MB
- SHA256 6ff0ef9620719cc11521c22b17eea4f7e5410ecfd67d60714e6e5bc0f13dd678
- MD5 7f555dea7f731c6f1caab54219ef33b7
- SHA1 96c12a3acab6512a40c698588a2f2fd5dc962c5b
- SHA512 65c17f6deebc25ba6c7b299b152213277beb1d8a8e5485a671e9953914d96000a51751a4afb53f8081db2996eb14149591ae78e2a02f0411d437d801ee5b2bc3
- SSDEEP 49152:Ph517DFYLfhiSJJv2L5A2sJ5ccW9Jn46WuA35ELX6a7W69MddiUD2pCxV6+gamRg:gHO
- TLSH T14E865E037B4800D8C867EEB080B54A7951B03DDD9631BA5B8DE97EA41F1A3996FEDF01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Remus stealer
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.