salatstealer | acbf9907125c9904d5f1ce3660c666d31c9961165fcc331a41aadc517160ff33

General

Target
2026-07-06_c6a7c494e23d0cb9d364e52b5b1b78ba_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch
Size 12.3MB
Sample260707-bd3axaez3t
SHA256 acbf9907125c9904d5f1ce3660c666d31c9961165fcc331a41aadc517160ff33
MD5 c6a7c494e23d0cb9d364e52b5b1b78ba
SHA1 918d0497249a241176628c5d9a026c84d4a89012
SHA512 f02901b76ff0bf14f7d0b96a640c2c18819f84c3d5c9ac8f4659c5ae6c5fda84260088378685e2762e98142032b2964b0c86e594834f5e869bf2df6d57eae7c5
SSDEEP 49152:zg6cu2shRPJUxznFNntzxvewWBf1dXnxHEwteX7QdZrZyfEnvh3LeG5yLmdy/0Li:9cBsENn5NlWbd5UQdF53dyzBr4qIE
TLSH
T14AD65B11FA8796F6F9036831416BB27F23305D048F24DBDBEB087A2AF8776911D6A705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-06_c6a7c494e23d0cb9d364e52b5b1b78ba_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch
- Size 12.3MB
- SHA256 acbf9907125c9904d5f1ce3660c666d31c9961165fcc331a41aadc517160ff33
- MD5 c6a7c494e23d0cb9d364e52b5b1b78ba
- SHA1 918d0497249a241176628c5d9a026c84d4a89012
- SHA512 f02901b76ff0bf14f7d0b96a640c2c18819f84c3d5c9ac8f4659c5ae6c5fda84260088378685e2762e98142032b2964b0c86e594834f5e869bf2df6d57eae7c5
- SSDEEP 49152:zg6cu2shRPJUxznFNntzxvewWBf1dXnxHEwteX7QdZrZyfEnvh3LeG5yLmdy/0Li:9cBsENn5NlWbd5UQdF53dyzBr4qIE
- TLSH
  T14AD65B11FA8796F6F9036831416BB27F23305D048F24DBDBEB087A2AF8776911D6A705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery salatstealer stealer upx adware persistence spyware
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2