salatstealer | 8e889fda0889cd71d9bdb57fb5fef569e7653ecf1bafb059fd2983294904f9fe

General

Target
2026-05-31_16764b6098ed7a47228aa58c56929171_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 12.0MB
Sample260531-tlqaescs5x
SHA256 8e889fda0889cd71d9bdb57fb5fef569e7653ecf1bafb059fd2983294904f9fe
MD5 16764b6098ed7a47228aa58c56929171
SHA1 c24ebcdcaaf7197d57cef094f8633e4abb0476c2
SHA512 2d6539acef7c2e11662fe633f28731ea1bc08610a22e9d29f9eca8663a286fee651cec834704a659c221656e4db456d6a6c17ff79ab4143d48080ba8c3267b75
SSDEEP 98304:vkD0Ro5Yp+ECJNTc2WHd9z8UZp4j3HxmcEsO/:5Ro7/N83z1X8MsO/
TLSH
T1B1C66B11FADB95F6E903583100ABB37F63315D048B28DB9BEB547B2AF8776A10C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-31_16764b6098ed7a47228aa58c56929171_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 12.0MB
- SHA256 8e889fda0889cd71d9bdb57fb5fef569e7653ecf1bafb059fd2983294904f9fe
- MD5 16764b6098ed7a47228aa58c56929171
- SHA1 c24ebcdcaaf7197d57cef094f8633e4abb0476c2
- SHA512 2d6539acef7c2e11662fe633f28731ea1bc08610a22e9d29f9eca8663a286fee651cec834704a659c221656e4db456d6a6c17ff79ab4143d48080ba8c3267b75
- SSDEEP 98304:vkD0Ro5Yp+ECJNTc2WHd9z8UZp4j3HxmcEsO/:5Ro7/N83z1X8MsO/
- TLSH
  T1B1C66B11FADB95F6E903583100ABB37F63315D048B28DB9BEB547B2AF8776A10C66305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery salatstealer spyware stealer
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1 behavioral2