salatstealer | xebcb64a85fb532d117281ea9ac4cae7ad05d599307b2117b5e39ba9216bad250[.]exe

General

Target
xebcb64a85fb532d117281ea9ac4cae7ad05d599307b2117b5e39ba9216bad250.exe
Size 12.3MB
Sample260701-e9ljtaev4q
SHA256 ebcb64a85fb532d117281ea9ac4cae7ad05d599307b2117b5e39ba9216bad250
MD5 679f65d046ff0c6d412dbe577d4487fa
SHA1 cb35f2e07cdd3c06acdb22a4998060c53a4f2381
SHA512 d4c02b99c5bf39418cab7f68be3f07d7bcfe4529d8379ab5b7da42c92275a739459807b4974bf2521f40e0e17a3c447a02dc17a5f0baf652a4cd6e0031ceaeee
SSDEEP 98304:MwFqAPETaaPZB6JmouJ8cR8YJrt48G2nNYEg:sASRnoMR8Y1tLT
TLSH
T1BFD65B11FE9B94F6E903187145ABB23F23305D048B38CB9BEB547B2AF977A911C36245
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
sample	family_salatstealer

Patched UPX-packed file 1 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
sample	patched_upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xebcb64a85fb532d117281ea9ac4cae7ad05d599307b2117b5e39ba9216bad250.exe

xebcb64a85fb532d117281ea9ac4cae7ad05d599307b2117b5e39ba9216bad250.exe

.exe 12.3MB

SHA256 ebcb64a85fb532d117281ea9ac4cae7ad05d599307b2117b5e39ba9216bad250
MD5 679f65d046ff0c6d412dbe577d4487fa
SHA1 cb35f2e07cdd3c06acdb22a4998060c53a4f2381
SHA512 d4c02b99c5bf39418cab7f68be3f07d7bcfe4529d8379ab5b7da42c92275a739459807b4974bf2521f40e0e17a3c447a02dc17a5f0baf652a4cd6e0031ceaeee
SSDEEP 98304:MwFqAPETaaPZB6JmouJ8cR8YJrt48G2nNYEg:sASRnoMR8Y1tLT
TLSH
T1BFD65B11FE9B94F6E903187145ABB23F23305D048B38CB9BEB547B2AF977A911C36245
MD5 SHA1 SHA512 SSDEEP TLSH

Detect SalatStealer payload
Patched UPX-packed file

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

496496

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths