salatstealer | e18db02d182cf07f7bb151b8757fca89f173bfcff6544e5529b51e67ef358f40

General

Target
2026-06-01_87828fbf1443e1e533efac6706904372_akira_amadey_elex_glassworm
Size 4.8MB
Sample260601-phbkmsdv5n
SHA256 e18db02d182cf07f7bb151b8757fca89f173bfcff6544e5529b51e67ef358f40
MD5 87828fbf1443e1e533efac6706904372
SHA1 8eafd6e5b7536848734a5f45e058b5d7739d05ff
SHA512 4eeab002dfcb3fc6bd3b43f7bf0156d3108429c47f311806ef8963666562ed4e620e1551910350707f1d529e61bd40c47af59b643d38300e1ae262e93534b5dc
SSDEEP 98304:6blK0pNbJMib4zJc4vy5YzUXfjLwQ0qnh8kuT0AD9ZCSgm:Fkp27K5YzufHw7qDuYARgVm
TLSH
T10636CF037BFEB05AEAAB97B4957466418625FC770D51908E31CC148B4F9B9007EBC3BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-01_87828fbf1443e1e533efac6706904372_akira_amadey_elex_glassworm
- Size 4.8MB
- SHA256 e18db02d182cf07f7bb151b8757fca89f173bfcff6544e5529b51e67ef358f40
- MD5 87828fbf1443e1e533efac6706904372
- SHA1 8eafd6e5b7536848734a5f45e058b5d7739d05ff
- SHA512 4eeab002dfcb3fc6bd3b43f7bf0156d3108429c47f311806ef8963666562ed4e620e1551910350707f1d529e61bd40c47af59b643d38300e1ae262e93534b5dc
- SSDEEP 98304:6blK0pNbJMib4zJc4vy5YzUXfjLwQ0qnh8kuT0AD9ZCSgm:Fkp27K5YzufHw7qDuYARgVm
- TLSH
  T10636CF037BFEB05AEAAB97B4957466418625FC770D51908E31CC148B4F9B9007EBC3BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Custom signature
  
  Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Custom signature
  
  Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Enumerates VirtualBox DLL files
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VirtualBox drivers on disk
  defense_evasion
- Custom signature
  
  UPX dump on OEP (original entry point)
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2