salatstealer | bb81cf5077448aa341ebf3322c74215f5fda979b8c4a2d0c3ac3bd3835e983ce

General

Target
Xeno-v1.3.30.zip
Size 88.1MB
Sample260419-bpcvdsa14l
SHA256 bb81cf5077448aa341ebf3322c74215f5fda979b8c4a2d0c3ac3bd3835e983ce
MD5 c827b94eec2564902e2232d836533b4b
SHA1 9aa04799cd4f99d48c4a177397f54e7b05e99d4d
SHA512 0d85e98a733b80edc0190ac46ead4031fc2a6c5e32429e71fecd69007389c9a5488fbb792d64e46c144a0118f1723b43f762cdce1dc6e85d12757f46d559a402
SSDEEP 1572864:JH2QpELqBwrU671cRoDVnhJSv1DQZYGIHkPHxYmu6ZLl+9ndo0zVMR/AN:xjpENU67u6Je9DAYGIH92Zsxd7lN
TLSH
T17C1833F039E91515E2385220C1369F19117B63B297EAC28B7F66069A93CEC9D4FFC172
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Xeno-v1.3.30.zip
- Size 88.1MB
- SHA256 bb81cf5077448aa341ebf3322c74215f5fda979b8c4a2d0c3ac3bd3835e983ce
- MD5 c827b94eec2564902e2232d836533b4b
- SHA1 9aa04799cd4f99d48c4a177397f54e7b05e99d4d
- SHA512 0d85e98a733b80edc0190ac46ead4031fc2a6c5e32429e71fecd69007389c9a5488fbb792d64e46c144a0118f1723b43f762cdce1dc6e85d12757f46d559a402
- SSDEEP 1572864:JH2QpELqBwrU671cRoDVnhJSv1DQZYGIHkPHxYmu6ZLl+9ndo0zVMR/AN:xjpENU67u6Je9DAYGIH92Zsxd7lN
- TLSH
  T17C1833F039E91515E2385220C1369F19117B63B297EAC28B7F66069A93CEC9D4FFC172
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Xeno-v1.3.30.exe
- Size 88.4MB
- SHA256 55dc3d80eefa1a276c12f81605e3ce10147aa1ef44e6d45bb864fb2bc8e1a2bb
- MD5 84b757d64642c4b6f62f6fdf9d36c9cd
- SHA1 f4014f52586274a80b3b393319d4cd2cf0d6760e
- SHA512 980456290c373b9cc8556220bb3669f87fd5e649580ee3e5ddad506f732252b5d0ff1f3c63be947b2a4ff0631223dfd33d1a381d67b501081c17a344313db9b1
- SSDEEP 1572864:/gC3nXn8ry0r2jh0Ms3pm9wZm6gJbhkqD1wlE+48T58g8ttDCcO:H3nXnRj2fm9v6+e2uh48KgytbO
- TLSH
  T1E91833A008954CE9E328E5BDF6818675F079FEBA96ED62853E76B3375435CAC04E0C31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect SalatStealer payload

Family: salatstealer

Checks computer location settings

Executes dropped EXE

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4