salatstealer | 2025-03-30_016e2058877a4f94267f2237d3ebfdae_frostygoop_poet-rat_sliver_snatch | Triage

Sharing

General

Target

2025-03-30_016e2058877a4f94267f2237d3ebfdae_frostygoop_poet-rat_sliver_snatch
Size

11.1MB
MD5

016e2058877a4f94267f2237d3ebfdae
SHA1

5a23932802b7a1a8990941076a1da065ba225852
SHA256

e7345cc77fd4b1581ffec1081fa1e0ba3d916f877c145d246052be12fd74af30
SHA512

b548f0b04dcb29569830d36e6bfc7a0476ac0096927e5840e1f9c3219f46f10307a4c7b6df9258173963d4e0d3e32f868edfbdc232c4531f4464ac382c13511f
SSDEEP

49152:aYYn0qsmj5ZeAwgH3wXwYjXeNUdKPfkSxN03x6c/9DDIc6cuRdN4I5ALIrHa64cI:rA0qs4hwMrmC3e16FPj2u5+PvSag

Score

10^/10

salatstealer

Malware Config

Signatures

Detect SalatStealer payload 1 IoCs

resource	yara_rule
sample	family_salatstealer

Salatstealer family
salatstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-03-30_016e2058877a4f94267f2237d3ebfdae_frostygoop_poet-rat_sliver_snatch

Files

2025-03-30_016e2058877a4f94267f2237d3ebfdae_frostygoop_poet-rat_sliver_snatch
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 334KB - Virtual size: 627KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 224KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ