salatstealer | 44cfe237e801bf9a9b36e20216151e0353c4daa17ae3369819c2c8bcb4ed2bb7

General

Target
Xeno-Sploiter-For-Roblox.zip
Size 26.9MB
Sample260705-y5mqvsfv51
SHA256 44cfe237e801bf9a9b36e20216151e0353c4daa17ae3369819c2c8bcb4ed2bb7
MD5 fa5b4066fdf615ec4e1fc42bb3a68c29
SHA1 df14f8884d618d097066b915861d36a527b2ff8d
SHA512 c39b44273f3d33858e97ae3e0ef6b790dcfda922e3a23606ccd53f8b4b89846a7220e1cb8ab1894fe702164c6f020fe3ccfad1a680160fb269f36f2ced50702d
SSDEEP 786432:Uv4YBOIifJzH7isSwtLdqtpFXtY2fKd5pS:Uv4RIiBBVxA+2K6
TLSH
T1F55733B173D26B24D09E1DBE967C8307E06D4D2AA508FE047844DBF0E4AC5EE69C52ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Xeno-Sploiter-For-Roblox/Xeno.exe
- Size 25.7MB
- SHA256 f0b21a9f68d2be771a1e3ce61f34f8c5cc99425d1e9899be3f000b78d13560eb
- MD5 e0511c2dabf6dd136fbd250fc1b8458c
- SHA1 865f1dcedcd5a03599a67d361cc9dc1e199975ae
- SHA512 658d5e62d5cb68900dbb25e61aa2e2e7f0343c19d8ef74d453775aedc311b60bfb88a6e8e633a27bb47cd9a8109f0cc7924965ad309390f59ddf454e2b02c0b5
- SSDEEP 49152:PN1W+LW5JnTY4rBp+J94BirMxlbmrIqtYaD82CIyMmpwayAH1fe8YCELyyZHnsUo:P+
- TLSH
  T137478C7FC13B0827AE9B67C58C591ECEDC4CE7512710646966AD188EC728EBEC0E1637
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution salatstealer persistence stealer
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1
- Target
  Xeno-Sploiter-For-Roblox/samlib.dll
- Size 375KB
- SHA256 38269befaa2740c0f1c312e8cef908fa2304ca1e484cff5e4eb2d2e32a93baef
- MD5 02c2f83be29fe0fb5429e2e05893174b
- SHA1 a835958002826d82348afa49f26063b70c6195c9
- SHA512 d6ebacf047bea6e133ac77786d041b38ceb28e526c62fc480db285e1dbc980b96c3ea0cfeb840be92f046cd6988d8384e63512a4fe2db9cccc4035b966657545
- SSDEEP 6144:zBtoNRT6D8PYylCB2OZcxyn7mFOlLVRqWz/GYkgeMiAEfUkVc+9tGC89s:z4tzPM1J7mUhrH7+J1Ax+4u
- TLSH
  T11D84236664B04C91C99A4E1C0C5372A6F907DCECDB47087C6B736C925EA18A835DACFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Xeno-Sploiter-For-Roblox/scripts/languages/socket.dll
- Size 550KB
- SHA256 34e360f5bff617c83694e7b984573ee5c66d85e438fbc8da6c1d46da6a1127d2
- MD5 f48a4e4370652e04941fad61c05843dc
- SHA1 2017394a6057a3a84f472b0d070bd51ec3a1e90e
- SHA512 8d433ea107dc37ce0e898a92cf190e1c747ab09c05b135208e33940d571cf9c1f083f33e3f46cfb74f8c602cb8d204cfbbea8c1eebb607439931f95a3ee8f987
- SSDEEP 12288:6DLfiMHsAHdABpUSQ0a/57myCGDIR4fHRqpb59SLK7og2MDlQkG5:gLfil4APxQ007CGDJgS+7otkG5
- TLSH
  T15BC4337163FD11C2DCC9A49B499DF3DADE14820EA9A6B0346FC3B9F1F0948A5932D970
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Xeno-Sploiter-For-Roblox/scripts/quick.dll
- Size 316KB
- SHA256 60d6872f49c0e6a0197f7d08fe6ff765dbf8892f3ca795f7c0b1e491ce7972e2
- MD5 6ea49b42508faac34eea3acd48511e69
- SHA1 c2f9c022ab9040591dd4540aceaee87f9d38c150
- SHA512 677f1fedd81266692fe3a074c2fadc120dcf0649f2790ba10c9fc83a407ce726646dae9aaa63ac8d56552f3f8eda27770ac3d066943a8217a264b9e2f57ee5ab
- SSDEEP 6144:f1vhUfO1PcM0Tp9eAuYwlI9euFWH15T0TPT5Ji+qqxNUuEA+T0vowoa2LK4:fphieEMap9rudR+rjT5Jr9vUuIT0vLib
- TLSH
  T1FE6423C9481963367F894844A08F5C61C5A36BF2636BC84DED1BBD3B9409B378793C5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4