2026-09-26_113169646a837200128b65d5785211be_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver
Named stealer, high entropy, evasion
Massive self-signed PE is mostly overlay paddingFile changed after it was signed
SHA-2564b23962bb5a3bd20596e0b4e524f4b169bbdd96eb7114594297ac57b72542579
Evidence
⋯3 more rows
0x5f000000000000000000000000000000000................
0x600ff20476f206275696c642049443a2022. Go build ID: "
0x6103639496d2d39643251726242525a2d4169Im-9d2QrbBRZ-A
0x620424e4e382f7153655f446377635a7157BNN8/qSe_DcwcZqW
0x6307670734a67374157412f556161736c4evpsJg7AWA/UaaslN
0x640492d634d5f524a466279686e62432f64I-cM_RJFbyhnbC/d
0x6507a70794e7a57644762354649796c5844zpyNzWdGb5FIylXD
0x660486d53220a20ffccccccccccccccccccHmS". ..........
0x670cccccccccccccccccccccccccccccccc................
0x680554889e54883ec10488b0d6973530048UH..H...H..isS.H
0x6908b155a7353004839c87d18733248c1e0..ZsS.H9.}.s2H..
0x6a004488b0c02488b5c02084889c84883c4.H...H.\..H..H..
0x6b0105dc34885c9760d488b02488b5a0848.].H..v.H..H.Z.H
0x6c083c4105dc331c04889c1e851de0500e8...].1.H...Q....
0x6d06cde050090ccccccccccccccccccccccl...............
0x6e0900fb6481783e11f4883f9117505488b...H....H...u.H.
0x6f04040c331c0c3cccccccccccccccccccc@@.1............
0x700554889e54883ec100fb6701440f6c601UH..H.....p.@...
0x71074560fb6701783e61f4883c6ef0f1f00tV..p....H......
0x7204883fe08773c488d0df3d93200ff24f1H...w<H....2..$.
0x740eb28488d7050eb22488d7058eb1c488d.(H.pP."H.pX..H.
0x7507038eb16488d7038eb10488d70506690p8..H.p8..H.pPf.
0x760eb08488d7030eb0231f64885f6742d0f..H.p0..1.H..t-.
0x770b756066685d2750631d231f6eb0f8b7e.V.f..u.1.1....~
0x780084801fe4881fa00000100771c4889f0.H..H......w.H..
0x7904889d34889d94883c4105dc331c031dbH..H..H...].1.1.
0x7a04889d94883c4105dc3bb00000100e86dH..H...].......m
0x7b0de050090cccccccccccccccccccccccc................
0x7c0493b6610762d554889e54883ec080fb6I;f.v-UH..H.....
0x7d0481783e11f4883f914750a488b404048H....H...u.H.@@H
0x7e083c4085dc3e816ffffff4889d84883c4...]......H..H..
0x7f0085dc34889442408e8a3ba0500488b44.].H.D$......H.D
0x8002408ebbccccccccccccccccccccccccc$...............
0x810cccccccccccccccccccccccccccccccc................
0x820554889e54885c0740631c931d2eb0b31UH..H..t.1.1...1
0x830c05dc3488d48014889f0488d1c49488d.].H.H.H..H..IH.
0x8401c594889c690488d3c08488d7f014885.YH...H.<.H...H.
0x850db7c3a0fb63f4189f883e77f4889c848.|:..?A.....H..H
0x87001fa41f6c08075bb4883fa017509807e..A...u.H...u..~
0x24d18000000000000000000000000000000000................
0x24d19000000000000000000000000000000000................
0x24d1a000000000000000000000000000000000................
0x24d1b000000000000000000000000000000000................
0x24d1c000000000000000000000000000000000................
0x24d1d000000000000000000000000000000000................
0x24d1e000000000000000000000000000000000................
0x24d1f000000000000000000000000000000000................
0x24d200000000015f0101420001740001680101...._..B..t..h..
0x24d2104600017300017800016b00017600016dF..s..x..k..v..m
0x24d22001015200016c00017000016300016e00..R..l..p..c..n.
0x24d23001750001610001790001670001660001.u..a..y..g..f..
0x24d2406f01025830010258310102583200026fo..X0..X1..X2..o
0x24d2507300026e780002696f00026b73000273s..nx..io..ks..s
0x24d26070000270630002666e0002666401024fp..pc..fn..fd..O
0x24d27070010246640102497300026d75000272p..Fd..Is..mu..r
0x24d2806f0102496e0002743100027432010258o..In..t1..t2..X
0x24d2903301024c6f0102486900026c6f0002683..Lo..Hi..lo..h
0x24d2a0690102446f010250430002627000026ci..Do..PC..bp..l
0x24d2b072000270700002696400027231000272r..pp..id..r1..r
0x24d2c0320002673000026770000272670002772..g0..gp..rg..w
0x24d2d067000272740002726400027774000277g..rt..rd..wt..w
0x24d2e0640002706400026b7000027469000274d..pd..kp..ti..t
0x24d2f07401025834010258350002736101024ft..X4..X5..sa..O
0x24d3007200036b65790003666d7400036c656er..key..fmt..len
0x24d310010353756d0003657272000362756600..Sum..err..buf.
0x24d320036d7367010343617001034c656e0003.msg..Cap..Len..
0x24d33074616700037479700103537472010345tag..typ..Str..E
0x24d34072720003656f6600036f666601034b65rr..eof..off..Ke
0x24d35079000370747200037061640003776964y..ptr..pad..wid
0x24d360000361726701034e6577000370666400..arg..New..pfd.
0x24d37003736574000372617701034d73670103.set..raw..Msg..
0x24d380446c6c01035061640003646c6c010342Dll..Pad..dll..B
0x24d3907566010347657401035461670103496euf..Get..Tag..In
0x24d3a074010353657401034f75740003726574t..Set..Out..ret
0x24d3b0000366756e000376616c000361646400..fun..val..add.
0x24d3c003656e64010352313601035233320103.end..R16..R32..
0x24d3d0507574000370696e0103416464000362Put..pin..Add..b
0x24d3e073730003626164000367657400037375ss..bad..get..su
0x24d3f0620003706373000363617300036d6178b..pcs..cas..max
0x24d40000036d696e0003706f7000036f626a00..min..pop..obj.
0x24d41003707574000373657100036763770003.put..seq..gcw..
0x24d420746c7308036d4f530003736967000371tls..mOS..sig..q
0x24d4307479000372756e00037273610003726fty..run..rsa..ro
0x24d440700003776f7001035479700103416e64p..wop..Typ..And
0x24d45000046d61696e01044164647200046b65..main..Addr..ke
0x24d46079730004656c656d010453697a650004ys..elem..Size..
0x24d47068617368010452656164010447726f77hash..Read..Grow
⋯14 more rows
0x52f150580059005a007b007c007d007e007f00X.Y.Z.{.|.}.~...
0x52f160f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0................
0x52f170f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0................
⋯4 more rows
0x52f1c0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0................
0x52f1d0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0................
0x52f1e0f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1................
0x52f1f0f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1................
0x52f200f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1................
0x52f210f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1................
0x52f220f1f10202020202020202020202020202................
0x52f23002020202020202020202020202020202................
0x52f24013030303030303030303030303230303.............#..
0x52f2503404040444f1f1f1f1f1f1f1f1f1f1f14...D...........
0x52f260000000000000000090fd8e75d3baa63f...........u...?
0x52f2701813c9faf663b63fe479da8c588cc03f.....c.?.y..X..?
0x52f2808cd6fb391ac0c53f98ecb42d5ecfca3f...9...?...-^..?
0x52f2900c6802b916bccf3f3a070eab0744d23f.h.....?:....D.?
⋯4 more rows
⋯3 more rows
0x5463f000000000000000000000000000000000................
0x54640000000000040000000000000001002000.............. .
0x546410030000000000110000007fcb24000100............$...
⋯7 more rows
⋯3 more rows
0x55e665756e74696d652e697461626c696e6b00untime.itablink.
0x55e675676f3a6275696c64696e666f00676f3ago:buildinfo.go:
0x55e6856275696c64696e666f2e726566007275buildinfo.ref.ru
⋯7 more rows