salatstealer | 9fb0d3c8f9b3d574ccccd073b7d5dc6d5df94a0fc8605e828811afda89a77c46

General

Target
2026-06-25_510250be055dcbd0718b7c7d2988caf0_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch
Size 11.1MB
Sample260629-2dr32sgx3w
SHA256 9fb0d3c8f9b3d574ccccd073b7d5dc6d5df94a0fc8605e828811afda89a77c46
MD5 510250be055dcbd0718b7c7d2988caf0
SHA1 896a5db62311c7fd4edbc6cea08f92740a313b1a
SHA512 34e187d8d16b63d70a4fadadc481718f85b083313c1db4d8f73604934424299853cfe7a9e03cae142c8221ea0b462621f0ee4f4aab7dc72d06fb4840b95f755c
SSDEEP 49152:6wZwMC6NMJFzrY7MvQcYgXATz8KCRdlqTOPSVBHTNJYTs95V23wcOrVWhpbcSMjk:DSMC4Ok75cvQTTBHbLTcP+Lq5E
TLSH
T1ECC65B52FA8B58F9EA031831415BB23F23315D048B28DBDBEB547F6AFC7B6811967205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-25_510250be055dcbd0718b7c7d2988caf0_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch
- Size 11.1MB
- SHA256 9fb0d3c8f9b3d574ccccd073b7d5dc6d5df94a0fc8605e828811afda89a77c46
- MD5 510250be055dcbd0718b7c7d2988caf0
- SHA1 896a5db62311c7fd4edbc6cea08f92740a313b1a
- SHA512 34e187d8d16b63d70a4fadadc481718f85b083313c1db4d8f73604934424299853cfe7a9e03cae142c8221ea0b462621f0ee4f4aab7dc72d06fb4840b95f755c
- SSDEEP 49152:6wZwMC6NMJFzrY7MvQcYgXATz8KCRdlqTOPSVBHTNJYTs95V23wcOrVWhpbcSMjk:DSMC4Ok75cvQTTBHbLTcP+Lq5E
- TLSH
  T1ECC65B52FA8B58F9EA031831415BB23F23315D048B28DBDBEB547F6AFC7B6811967205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery salatstealer persistence stealer adware credential_access spyware
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2