salatstealer | 1f70554d87533f55afb492509dd72ba3e443923690f48deb8a9b8bd09b8826ec

General

Target
2026-07-07_adf109e97556b00d7ee7e688d5924e11_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch
Size 12.6MB
Sample260707-2rt5kags4n
SHA256 1f70554d87533f55afb492509dd72ba3e443923690f48deb8a9b8bd09b8826ec
MD5 adf109e97556b00d7ee7e688d5924e11
SHA1 74fc6ff668659dc8f2d9d8b0be744a74bd1c8fba
SHA512 65ad06d98b1309fb5cb02b605f6a24433a301664c927f673a6f46ffc9be4a2268b0c7d3862b3a8ce1114fd6bcd55c99565d7a2259c55d9b9e0f5d47b34b18f6d
SSDEEP 49152:PE6KiXwhZMKX41WQw9JxdNPCpYs2tFVDbwrLyfGvUdP7XVOYHahsnipR6mSMFZOQ:5KUwNQw7/RCH25si5uiM+W4VLE5O/
TLSH
T1D3D65C11FACB54F6F9036831416BB27F23315D048B24DB9BEB583B6BF87769118AA305
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-07_adf109e97556b00d7ee7e688d5924e11_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch
- Size 12.6MB
- SHA256 1f70554d87533f55afb492509dd72ba3e443923690f48deb8a9b8bd09b8826ec
- MD5 adf109e97556b00d7ee7e688d5924e11
- SHA1 74fc6ff668659dc8f2d9d8b0be744a74bd1c8fba
- SHA512 65ad06d98b1309fb5cb02b605f6a24433a301664c927f673a6f46ffc9be4a2268b0c7d3862b3a8ce1114fd6bcd55c99565d7a2259c55d9b9e0f5d47b34b18f6d
- SSDEEP 49152:PE6KiXwhZMKX41WQw9JxdNPCpYs2tFVDbwrLyfGvUdP7XVOYHahsnipR6mSMFZOQ:5KUwNQw7/RCH25si5uiM+W4VLE5O/
- TLSH
  T1D3D65C11FACB54F6F9036831416BB27F23315D048B24DB9BEB583B6BF87769118AA305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery salatstealer stealer upx adware persistence ransomware spyware
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2