salatstealer

Resubmissions

09/06/2026, 16:13

260609-tpchqsew9q

05/07/2025, 13:22

250705-ql79fszls410

05/07/2025, 13:16

250705-qh6w8ayxcw10

05/07/2025, 13:15

250705-qg8dnazky710

Sharing

Copy URL Twitter E-mail

General

Target
rpd.zip
Size 8.8MB
Sample250705-ql79fszls4
SHA256 f6cc0f77262feca3dc6efe46d69557dc072e5197f31182c71bdc099fdf1b4af5
MD5 3fe451fab0077fbcd6468deaae5d5437
SHA1 a29dd13e59356cc00a4009e268824c99a9f58091
SHA512 2471614d3d54fb14299e958bfd92a274117eaad9e7d9e762358306711b286e856da64deec2e18d39ead88945114d755fd111049e26a2fedf813e81e653c2e1c4
SSDEEP 196608:Ya+pCQnNBPsBU8rFYxGm1ByTRCaI4ApoObKXQywCTkemBOD5rw:5p2BPsBKGm1ByTI9n8XQAPmMJw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  rpd/OculusHelper.dll
- Size 17KB
- SHA256 8fed1915baea76b43e8d75bc49309fc2ab5b19ec6ee6bd86bbb7d5e7d5baeab9
- MD5 f8db10a4fe83f160df693b88c8ac0d94
- SHA1 8fb7dfe016d60d20b20c2e50fbec33fac80aa986
- SHA512 5776bcbfc5094be137234b7d84c54530d68a8663fb3644a3827cbdb7733494f46c96d4dfe5862a87d5d3d0e624ee3cf1bf99c847d9e7dc4222745f04e915a251
- SSDEEP 192:nzVOpVcd/bWWR9LY2+/T9adrMAFbA9m99u+HKEFxd+4vnmyTqiVlR8eNJZ/j:nBOGYnb9d59mzu/EFxFmypzZ/
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  rpd/Rapid Rust.exe
- Size 148KB
- SHA256 563664af8d969e4a2433d927cde86c95d3ba42603b30fd3e50a8b8c53f763ae1
- MD5 c3fc0f96ee7d402a970190aced6fb910
- SHA1 5962ad00ea213220439e298d59e6ca8f53e66ecf
- SHA512 c19b5a88660f3e02e9afa5a28f9f2cdbd75f7d80f01a474e931cab38e7f94751eaeb6768e496adeab4c150898875ad07350f8adf07bdb69061f9fd32f149f4be
- SSDEEP 3072:85vnr5Tbx829UOeKnn2LFzZBp13u36wKp4zULCmoU:8BKjK2LFzZNfIULf
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

salatstealer credential_access defense_evasion discovery execution spyware stealer trojan upx
- Detect SalatStealer payload
- Salatstealer family
  salatstealer
- UAC bypass
  defense_evasion trojan
- salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  rpd/System.ComponentModel.Primitives.dll
- Size 73KB
- SHA256 1b00f2d90f6830c6f4dd7bfade4edf41ab7a42f716223704ebb0b4b746e3625e
- MD5 3a25c91bcbf4970a6a27dbf2c0f8c6a8
- SHA1 be0e29c7bc269f4ee56f7b24b6968384315d57d7
- SHA512 bf1c5844b1d042b8968d1b51d75ac86e640bf4fe52c8a12ec5d3ab08658f993aed577d2962dd7bc58be927291b557a8d9d68fea0386ca72fc510bb13ec00fc0e
- SSDEEP 768:UxI98FwPKQAtTKNI6T1mb1yF0YDC2oKQ15h498Q8a7iFClJds9znCd6:2ITuP6kYFlC2oKQ6y8uiJdkznCc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  rpd/System.Console.dll
- Size 153KB
- SHA256 509848bb0f4551253694749fc2a94b99e3d7414fb72110f31de3356859a1e800
- MD5 765d7a70783f0e3d7d93cf549ef4e1bc
- SHA1 45afcf5538bcadb6cb558be1865b04d74a456811
- SHA512 c3c1d1dd9c844c0487a25bf1115216ef0c4860b38afa7a978742aaab2eba796b090bad42e2b6fd2e159a72bcb38f2551f270720964e860869facf32204fc5f1f
- SSDEEP 3072:+9SMiIGbCwq+p14axXwbK80tmOaYMGK1T:eQj9RcclKB
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  rpd/System.Diagnostics.Process.dll
- Size 283KB
- SHA256 1bcb92989f22b2d8efee51538f7f369d7cc61fcf17ea1bdda158cde557420853
- MD5 ba09f2ef8da85dfbc26f9e3f1f1cafec
- SHA1 3ed037953eeeba18668c38d2641f9fee2fddcf83
- SHA512 4244dce272bdced168bceb3f59376142e8cc04ffa7ee4f41c42f35aa51f2ae8e1ad4d71bc30df74f261c034d692c119153a7c30e0afe23200dd991ede6158404
- SSDEEP 6144:+4vmEeveJQADJujgkju83yxs9b3NX1PkxEqCS7s03Y12F:+4etveJQAdSvju8CjWb03Y1E
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  rpd/System.Memory.dll
- Size 169KB
- SHA256 2ee8e3efc4a7499d903da9829e88bba241f12a1c0a35e697f205f1de76aca762
- MD5 2ca529fbbed16eb3452080213b592c04
- SHA1 7688579d05bb2f7debb71e5255f07d6ee4f10e09
- SHA512 72393ddbaaaa22afd8b675981dfcafd3c38fed6373e61edefc7f9b2a577f5ca72ff5ed6046c601e01a84354d1f8b3bb8cd7d681cba816a4c9cbdb8a6579ba33e
- SSDEEP 3072:C0RPN4ab6HEuCKvSwOy6fM/vfovpPh/h/tmlIYrA6S1mUgMAxU:Zt+GKjtGPh/hwlU6EAG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  rpd/System.Private.CoreLib.dll
- Size 10.1MB
- SHA256 3ce6f27555e6ce2dc1d314012a5798a1a62b4527813c085548f7d937f83da74a
- MD5 5c013cbfce531163303352f70e120a38
- SHA1 012badfba622e533071610d6cba4cb10051bdebf
- SHA512 1a225963455b4876dc9b87e51468a9d9aab716d60ec142cdb59088f4698fc2f38b5f229d69ce0d7895b9f5e9251106b1395d53c45b835fa9ec6947d9f302575b
- SSDEEP 98304:KKd1eeIoZQsU+fRIwvUVvJS63bXYPrLAU4n/0v4/PyGvjv:tCoSsU+fRI/VvJSyXcOyGvj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  rpd/System.Runtime.InteropServices.dll
- Size 50KB
- SHA256 cab4e96d3ddf225acfb610a53ef299fb9e7deb74ab374e3976d799c77dfa8770
- MD5 8a6c9b36376252c6e6051e8a8c102a15
- SHA1 9a26de4bc0309dcfb301445132ec2de1721cc02e
- SHA512 97a3cb9cf801da36b75b92a00c6236d8aaaf9d819fcc8b8f3cca57b77426ccef692a17569c35ff6d59a631ea71735aa7d0265889bfb69f6ae2259e36d3e9be09
- SSDEEP 1536:34oWJIP8z2r1GqhwF3FMjyPPkmW9Iz0meJB:34oWikmgqhwNFMjyP9J9eP
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  rpd/System.Runtime.dll
- Size 41KB
- SHA256 3f5aaf220b671a8a14a8511226037421935cb827440cae6e302a719d378e543e
- MD5 1ac3454854febde3852415303a39244a
- SHA1 90a948df5a1d983a3c75afde77ac6c7bf93f4c07
- SHA512 8a5fb2dc85be78f98fbcb8314ec179e6733ea9f0bb28e7df940b20cf9676db64c665dcabf2f613a9f6f0f0caaa2d8395ca601c05795001130582205b573bba70
- SSDEEP 768:Q0BV0jdpFKYl5f4bGRi2xVbcVT4pftsFCltVXC4dC9zVjDk:QIedGYl5f4bGR3G0BtoiHC4dezFo
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  rpd/System.Text.Encoding.Extensions.dll
- Size 15KB
- SHA256 67cb9174a2ce49e07d6653fb697ef7834847ac76be651a3df9a4d249bf55e606
- MD5 bd91048ac53ce4e78125ab6d4f9bdbd8
- SHA1 a100addbe8c1fef6b8ef8f59d08aee22cbd23e8a
- SHA512 49faf553486eacf71f579b929ccd35dfd9f7a25a72627e1080f5315a259fd65ee6875c10cfa73099d56f2027e48bb265852a4d8fdd823def38e404116b5a4754
- SSDEEP 192:7GZv4pxxhhW6YJWh4WxNzx95jmHnhWgN7agWKnOafKUSIX01k9z3AXxXk:7Iv0XhW6YJWhXX6HRN7H2IR9z6O
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  rpd/System.Threading.dll
- Size 78KB
- SHA256 dc2ac768bb9b05766b009b6efaef4479d5db5c768ee1d3de3eda136e420ff94c
- MD5 a2014966d8f40bafe07dd3a92ef0dbc0
- SHA1 1c68842050bef3d29dc3f3322ece3da4fac64e62
- SHA512 5e4659db98519b227cfef73c1ad7618f9f1e8e84e276276bc338d1f5263cdcc58651e0531fb386ccd2ea65a877652494b80fae01807dcefe4edc5413c90dbe77
- SSDEEP 1536:hk5RkjKu+ydo98uGxdzJERH7AveMWrJ9zC:hk5Rkdo9wxdzGKveMo3W
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  rpd/System.dll
- Size 49KB
- SHA256 20864e27e43a327b96d26cfc46b7568f3f263c759ad7dac2395efff791727bc3
- MD5 2bebb27c3514d212eb44bc82e263fffd
- SHA1 c7d18aa44727c981b62e349dade1eec52433ef4f
- SHA512 3845e108c47dca73e9e8ef0caf5458a12383435031e1351339cd0756e82f4b9092d7378e9e4513594d9ced82f8dba59521c43be3390abdda694acba9b572e783
- SSDEEP 768:FQuoy1c6A2ZX8TRNH5JVbOd502zq1TntVx6WUCR7in9zp:FQuoO3ZX8Q5jzC3x6WUZ9zp
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  rpd/clrjit.dll
- Size 1.4MB
- SHA256 cdba2919e1f7288e8f07986d9d4927f1114433db7fb6fd352f8fab03c53668e0
- MD5 3cca64f0ea30143e44324f97d1830442
- SHA1 ac21268cb0855497af0341042eb999e096fea69e
- SHA512 437a66f4421deb2fa70c3037d1c3aa7c1399136b2eae31dcdef99541edb8de430754a1c7051fb7786973fd0185c7b1f7f7122c1fa3ac49b21fb4e7f217ee995c
- SSDEEP 24576:wLtbu58TIu2rlMBDr0PZYRhVj95f1L7Zr5/z/5ccUYXIBXzkTVsHgWolUZbGyqfj:wLtHAcX0PZuhVDh7ZN7/6YXIBjkBsHgZ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  rpd/coreclr.dll
- Size 4.9MB
- SHA256 fe0ae2120e2b298e1c40f8fda3845aa44d3da6afe3037af4f982b0dd63e4356e
- MD5 4bbe312359267a55988df83d4f9b8eb4
- SHA1 6297fbb90a87ffecf9d3460bf9ad945e9514e463
- SHA512 7ea2b5bd8a1641c5f144264485332943c9d36afccccbab5a633f27f2fc9f27a4fa866aff7b9823e2e0c3ba2e3a3fa3e4e3832b48af376a95ae95ccdce4ab04ff
- SSDEEP 49152:eRRteSC8CjfXq6EoB/SEsRfoSakEd9c6oWUqCJ0OTVRepih8IdCdTWOVxJYaHmnz:iRqXB/SEAKJspr8wKQXt
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  rpd/hostfxr.dll
- Size 369KB
- SHA256 82ab369e059533eb7952855b7cc55916ab6b91fb36b2922f269037b1974be627
- MD5 5d8596283ce9ea677b1ffc73c5fdc536
- SHA1 956f1a5d5249011d6f95c127ec8d7dd145763334
- SHA512 35fe41b0db7100aee3102674649974ee9640134720e05ce4ce434f0e9230d207e5c36313ef55ed5920211a549710e8cbd1483b57e13a9941dbea70b58573911b
- SSDEEP 6144:oGr5uLf+w7dEtiODC3+Gr4iAOs2dEAh2gcmgrW0985D:vmf+qdEzD/iAOsVVH9MD
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  rpd/hostpolicy.dll
- Size 385KB
- SHA256 266d2ae85fff170eb2795b495b019264d5a0e1cbd7f3f1c6a9cfe0317928399f
- MD5 1ab67b2d47d7559f90dccf639dc944c8
- SHA1 62cb9aa4f0d768aef3c9ff6256f205f43ee092c1
- SHA512 3f27dfe73e9b00290e4e0242ecfad8455dd3c4ee61c029fe570303feab8f40c87f3164251b0f906c670645ce94b1a7e6b47e5e36138de2753655e3fda1710d5d
- SSDEEP 6144:wBGjtN9JhCdJeD1QL3sQy8XyV0l0gzPI37VPzBz3BU89GhOfBE/Xzd:wBGjtNlU/rsQy8XyxzNCOeXx
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32