Overview

overview

10

Static

static

5

Flowseal/service.bat

windows11-ltsc_2024-x64

10

Flowseal/wso.exe

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    FlowsealObhod4.0.0.rar
  • Size 5.2MB
  • Sample260710-pwdbdsbw8p
  • SHA256 634349d3cd267af5993525c289efd740d980cff86289890088bd85db16a5eba5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
salatstealerdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationstealerupx

Malware Config

Targets

    • Target
      Flowseal/service.bat
    • Size 29KB
    • SHA256 044463b76875eab318e56b9dcb7e9d342f6ea56ed0caff9b854195bee5a488b8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionsalatstealerpersistenceprivilege_escalationstealerupx

    • Detect SalatStealer payload

    • Family: salatstealer

      SalatStealer is a stealer that takes sceenshot written in Golang.

      stealersalatstealer

    • Creates new service(s)

      persistenceexecution

    • Stops running service(s)

      defense_evasionexecution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • An obfuscated cmd.exe command-line is typically used to evade detection.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1
    • Target
      Flowseal/wso.exe
    • Size 713KB
    • SHA256 3493b52c5af7c4e66a28ee1968be3d39dd7c8261b940fa0735f3740435886f48
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Process Discovery

1
T1057

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks