Hostile ^92% Download

2026-09-24_e9aa953f4639b6a6e16e89c392b85523_frostygoop_hive_luca-stealer_salatstealer_sliver

Known stealer, embedded payload

Massive self-signed PE is mostly overlay paddingFile changed after it was signed

SHA-25628c26eb89789c89522b64b83ad0ff3d7ecda57811b936692baeea55feafc82dc

URLhttps://tria.ge/api/v0/samples/260926-h1ddmaxx6p/sample

MaleculeO₂(Er₄As₆)H₅(Cm₂CrDbMgOs₃)Md₃(Bi₁₂PtSi₄)

Evidence

Largest PE section below ten percent 0x580–0x870

⋯7 more rows
0x5f000000000000000000000000000000000................
0x600ff20476f206275696c642049443a2022. Go build ID: "
0x6105765422d4264717932525152314a474dWeB-Bdqy2RQR1JGM
0x6204553674b2f3152627353557439304a48ESgK/1RbsSUt90JH
0x6303542733353704d776f2f7a5a327361715Bs3SpMwo/zZ2saq
0x640586432527743314f625f615071442f56Xd2RwC1Ob_aPqD/V
0x650776e7652514257685049354134754e4ewnvRQBWhPI5A4uNN
0x6606e512d220a20ffccccccccccccccccccnQ-". ..........
0x670cccccccccccccccccccccccccccccccc................
0x680554889e54883ec10488b0d4910640048UH..H...H..I.d.H
0x6908b153a1064004839c87d18733248c1e0..:.d.H9.}.s2H..
0x6a004488b0c02488b5c02084889c84883c4.H...H.\..H..H..
0x6b0105dc34885c9760d488b02488b5a0848.].H..v.H..H.Z.H
0x6c083c4105dc331c04889c1e8b1050600e8...].1.H........
0x6d0cc05060090cccccccccccccccccccccc................
0x6e0900fb6481783e11f4883f9117505488b...H....H...u.H.
0x6f04040c331c0c3cccccccccccccccccccc@@.1............
0x700554889e54883ec100fb6701440f6c601UH..H.....p.@...
0x71074560fb6701783e61f4883c6ef0f1f00tV..p....H......
0x7204883fe08773c488d0dd3513e00ff24f1H...w<H...Q>..$.
0x730488d7048eb34488d7040eb2e488d7038[email protected]
0x740eb28488d7050eb22488d7058eb1c488d.(H.pP."H.pX..H.
0x7507038eb16488d7038eb10488d70506690p8..H.p8..H.pPf.
0x760eb08488d7030eb0231f64885f6742d0f..H.p0..1.H..t-.
0x770b756066685d2750631d231f6eb0f8b7e.V.f..u.1.1....~
0x780084801fe4881fa00000100771c4889f0.H..H......w.H..
0x7904889d34889d94883c4105dc331c031dbH..H..H...].1.1.
0x7a04889d94883c4105dc3bb00000100e8cdH..H...]........
0x7b005060090cccccccccccccccccccccccc................
0x7c0493b6610762d554889e54883ec080fb6I;f.v-UH..H.....
0x7d0481783e11f4883f914750a488b404048H....H...u.H.@@H
0x7e083c4085dc3e816ffffff4889d84883c4...]......H..H..
0x7f0085dc34889442408e803e20500488b44.].H.D$......H.D
0x8002408ebbccccccccccccccccccccccccc$...............
0x810cccccccccccccccccccccccccccccccc................
0x820554889e54885c0740631c931d2eb0b31UH..H..t.1.1...1
0x830c05dc3488d48014889f0488d1c49488d.].H.H.H..H..IH.
0x8401c594889c690488d3c08488d7f014885.YH...H.<.H...H.
0x850db7c3a0fb63f4189f883e77f4889c848.|:..?A.....H..H
0x86089d948d3e74883f9404819db4821df48[email protected]!.H
0x87001fa41f6c08075bb4883fa017509807e..A...u.H...u..~

Go version string 0x3e41e8–0x3e4308

⋯5 more rows
0x3e4238030100000000000000c0a30000000000................
0x3e4248676f312e32312e390000000000000000go1.21.9........
0x3e42581afa7a00000000000900000000000000..z.............
⋯11 more rows

Go runtime symbol presence 0x434d80–0x434e40

⋯3 more rows
0x434db02139773efe4edcb1ead1364e2e6973e4!9w>.N....6N.is.
0x434dc0b51248a055752bc83191f8940fd9c794..H.Uu+.1.......
0x434dd04d5d072f594c3403a8a1cf6ef53b6c4fM]./YL4....n.;lO
⋯7 more rows

Go main.main entry point 0x529210–0x5292a0

0x529210c9b5cf3499ee400725e7181680e82c4f...4..@.%.....,O
0x529220bd65627ee95ecca4d9457b373c9c237f.eb~.^...E{7<.#.
0x529230eabea5334d6ed7a7e90dcb2c4cc946af...3Mn.....,L.F.
0x5292401d61500369f12677d511481b48f94795.aP.i.&w..H.H.G.
0x52925000d932379d01bb87e5688e0b8cd47783..27.....h....w.
⋯5 more rows

Go syscall.Syscall function-pointer dispatch 0x5595a5–0x5596e5

⋯3 more rows
0x5595d57447657450726f634164647265737300tGetProcAddress.
0x5595e573797363616c6c2e53797363616c6c00syscall.Syscall.
0x5595f573797363616c6c2e53797363616c6c36syscall.Syscall6
0x5596050073797363616c6c2e53797363616c6c.syscall.Syscall
0x559615390073797363616c6c2e53797363616c9.syscall.Syscal
0x5596256c4e0072756e74696d652e6d6170696elN.runtime.mapin
0x55963569746e6f6f7000676f676f0063616c6citnoop.gogo.call
⋯11 more rows