Overview

overview

10

Static

static

1

loader.exe

windows10-ltsc_2021-x64

10

loader.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    loader.exe

  • Size

    3.3MB

  • Sample

    250328-rra2ksypz7

  • MD5

    15e82653a5e106d47b4b335f52b00ffe

  • SHA1

    eaefebdcb7201cee96ae9fbc16a0b3219a494db3

  • SHA256

    23692e0e981e1afad8f1cc3269f4558f0d281243934ea21559f7df8fb3d0242e

  • SHA512

    c8bacdc2de895e6046fe4dbbf54d65e0efed2f3862b6cb4b789affcb92b6a0e7196f1f50602368b2d5b8f301af5c7bd9dd6ab960de88e9b1ef776c79b056930e

  • SSDEEP

    98304:m5p8o+MOPyPWPkv+JEMh6XB96VKaxmpFK0fJMCn:mPn+MlPWPE+ZwB96Aimp02vn

Score
10/10
salatstealercredential_accessdiscoveryspywarestealerupx

Malware Config

Targets

    • Target

      loader.exe

    • Size

      3.3MB

    • MD5

      15e82653a5e106d47b4b335f52b00ffe

    • SHA1

      eaefebdcb7201cee96ae9fbc16a0b3219a494db3

    • SHA256

      23692e0e981e1afad8f1cc3269f4558f0d281243934ea21559f7df8fb3d0242e

    • SHA512

      c8bacdc2de895e6046fe4dbbf54d65e0efed2f3862b6cb4b789affcb92b6a0e7196f1f50602368b2d5b8f301af5c7bd9dd6ab960de88e9b1ef776c79b056930e

    • SSDEEP

      98304:m5p8o+MOPyPWPkv+JEMh6XB96VKaxmpFK0fJMCn:mPn+MlPWPE+ZwB96Aimp02vn

    Score
    10/10
    salatstealerdiscoverystealerupxcredential_accessspyware

    • Detect SalatStealer payload

    • Salatstealer family

      salatstealer

    • salatstealer

      SalatStealer is a stealer that takes sceenshot written in Golang.

      stealersalatstealer

    • Executes dropped EXE

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks