salatstealer

General

Target
file.exe
Size 3.8MB
Sample251118-tpblfawrds
SHA256 35fcd9a92974ed0a8866eebef90a00780afc1f6ecc70dec50c1e06eae047526a
MD5 1f3bf9342581be8a14c6b4cea6470d63
SHA1 d3bfb3998db260c9dca7f4e0dfbd185ef71fbb1c
SHA512 4c4f4cc95a43a39640788e600e66c006cdaab916fefb1a72d05aa062928e089f76176ca180e0ac0ea9f2cd6238cc9b9cae9eff0a6008f63c18d1b6be073c053a
SSDEEP 98304:eVb0FB32VdUw9SMsuEnwHx+Nd3JTIgTXLeU7:Wb0FB3am8DsHwHSPc6p7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  file.exe
- Size 3.8MB
- SHA256 35fcd9a92974ed0a8866eebef90a00780afc1f6ecc70dec50c1e06eae047526a
- MD5 1f3bf9342581be8a14c6b4cea6470d63
- SHA1 d3bfb3998db260c9dca7f4e0dfbd185ef71fbb1c
- SHA512 4c4f4cc95a43a39640788e600e66c006cdaab916fefb1a72d05aa062928e089f76176ca180e0ac0ea9f2cd6238cc9b9cae9eff0a6008f63c18d1b6be073c053a
- SSDEEP 98304:eVb0FB32VdUw9SMsuEnwHx+Nd3JTIgTXLeU7:Wb0FB3am8DsHwHSPc6p7
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence privilege_escalation spyware stealer trojan upx
- Detect SalatStealer payload
- Modifies WinLogon for persistence
  persistence
- Salatstealer family
  salatstealer
- UAC bypass
  defense_evasion trojan
- salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Legitimate hosting services abused for malware hosting/C2
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2