salatstealer | 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8

Target
keshka.exe
Size 3.4MB
Sample260420-tlkpyabz3w
SHA256 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8
MD5 20eef3d8647f48e17eb7f3804d836518
SHA1 fbe3a3f8d08c980ca36cf9f10ac9f72982d899dc
SHA512 8dc2e5f6568da07b03c7f793f7c70dfd7d48883d6fc473ab21931de02d41700f2d95c99a84047c1b144827573293fdd8d40b81219ce5a7d0605c6b7281f8f26a
SSDEEP 98304:J90zEmNW6ABeiCR3MBpTrJNpHfGYMZBCwLCta:X0rk6wwR3c3tH9MbCwLC4
TLSH
T12DF53300C54F7BFAEE5259B4F8DCC5814D4EC5089ED2D69F0A269B76AB43B1C820639F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  keshka.exe
- Size 3.4MB
- SHA256 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8
- MD5 20eef3d8647f48e17eb7f3804d836518
- SHA1 fbe3a3f8d08c980ca36cf9f10ac9f72982d899dc
- SHA512 8dc2e5f6568da07b03c7f793f7c70dfd7d48883d6fc473ab21931de02d41700f2d95c99a84047c1b144827573293fdd8d40b81219ce5a7d0605c6b7281f8f26a
- SSDEEP 98304:J90zEmNW6ABeiCR3MBpTrJNpHfGYMZBCwLCta:X0rk6wwR3c3tH9MbCwLC4
- TLSH
  T12DF53300C54F7BFAEE5259B4F8DCC5814D4EC5089ED2D69F0A269B76AB43B1C820639F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer miner persistence spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1