salatstealer | e5d90d1ddeccde56c2ed08493d8f09ba04f21447ad21eb909a300f924f8bb1e4

General

Target
2026-07-08_ff70b9b877f28933dd4b44e30c77c583_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 12.0MB
Sample260708-ts814sdv41
SHA256 e5d90d1ddeccde56c2ed08493d8f09ba04f21447ad21eb909a300f924f8bb1e4
MD5 ff70b9b877f28933dd4b44e30c77c583
SHA1 a3927234a1ba16f70bf909e1383835e81e084205
SHA512 0c349d847420214cd094c51d7ecdc6ebedf65582ca0d52a75093b7d2a3b6cd9e1c9adfa469c5c40cd4cb92ca8c43f6cc16c3955557032ef1c79514cd6b47877c
SSDEEP 98304:PLeG61elNbCGfnf0t0E6VzcV57O1714tG20CWEY:t6ajfffE6zZHCY
TLSH
T1E2C65B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-08_ff70b9b877f28933dd4b44e30c77c583_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 12.0MB
- SHA256 e5d90d1ddeccde56c2ed08493d8f09ba04f21447ad21eb909a300f924f8bb1e4
- MD5 ff70b9b877f28933dd4b44e30c77c583
- SHA1 a3927234a1ba16f70bf909e1383835e81e084205
- SHA512 0c349d847420214cd094c51d7ecdc6ebedf65582ca0d52a75093b7d2a3b6cd9e1c9adfa469c5c40cd4cb92ca8c43f6cc16c3955557032ef1c79514cd6b47877c
- SSDEEP 98304:PLeG61elNbCGfnf0t0E6VzcV57O1714tG20CWEY:t6ajfffE6zZHCY
- TLSH
  T1E2C65B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery salatstealer stealer adware persistence ransomware spyware
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2