salatstealer | 634349d3cd267af5993525c289efd740d980cff86289890088bd85db16a5eba5

Resubmissions

10/07/2026, 15:28

260710-swrqkaev3w10

10/07/2026, 15:17

260710-spesesby9q10

Sharing

Copy URL Twitter E-mail

General

Target
FlowsealObhod4.0.0.rar
Size 5.2MB
Sample260710-spesesby9q
SHA256 634349d3cd267af5993525c289efd740d980cff86289890088bd85db16a5eba5
MD5 51df26ef652338dfe92f0186a87550d6
SHA1 53f20dedbfde5bd33795f7b430be4520a36977e7
SHA512 e541c415bcf78f7b4eeeb8f2b1dcdc123e3d2719ea17af848717a99c3bc803e83344f6a1093ef2c8c12d90283c393557037d125d782a36bcf6935767ef7e6c9f
SSDEEP 98304:ESLKp3qS6FJ293yRJqiP02+UT6MA9WScq0i0UIKuaR8iZd+foAknndHccQN:E8S6FJ21yRJPUPR0iiIR8iv+foAknniT
TLSH
T1884633EC98F131C4B3AE148E8D3B9E5833E70A7909DE421ED1ADD05A259E60580D7B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  FlowsealObhod4.0.0.rar
- Size 5.2MB
- SHA256 634349d3cd267af5993525c289efd740d980cff86289890088bd85db16a5eba5
- MD5 51df26ef652338dfe92f0186a87550d6
- SHA1 53f20dedbfde5bd33795f7b430be4520a36977e7
- SHA512 e541c415bcf78f7b4eeeb8f2b1dcdc123e3d2719ea17af848717a99c3bc803e83344f6a1093ef2c8c12d90283c393557037d125d782a36bcf6935767ef7e6c9f
- SSDEEP 98304:ESLKp3qS6FJ293yRJqiP02+UT6MA9WScq0i0UIKuaR8iZd+foAknndHccQN:E8S6FJ21yRJPUPR0iiIR8iv+foAknniT
- TLSH
  T1884633EC98F131C4B3AE148E8D3B9E5833E70A7909DE421ED1ADD05A259E60580D7B3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Flowseal/general (ALT).bat
- Size 3KB
- SHA256 9962f65901a5a1eeece59fef58e0a9a2a181beaff4fb2465a2efa4ad6fff94f3
- MD5 8481a800831aeb932bea31c271ffa8f8
- SHA1 a00160da2701755dafbdecaa552e53ff2d884c9b
- SHA512 2c9a89eeb114c89d878865322436dadb32ac1f8a71fad574b95bfb851286f3549bd400d5df0d5955b4a4044e78e7ce32aab88c97c0f81dd0e8744c6a7f4f0741
- TLSH
  T188815CA7E00CDE47F5CDA53EF85FA6A420279C8328D6D452835B89E8CC4EDBD684E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence privilege_escalation spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2
- Target
  Flowseal/general (ALT10).bat
- Size 3KB
- SHA256 a814fd2004b7ca3cccaa7a8016ef7baf65fd3374996432c58392715768075783
- MD5 b7a8fc66c659a66e0d29b17f04e95bd8
- SHA1 2ba6db449c5ab5dedc05d534d28f01026c3b0b69
- SHA512 3e40872f790881eff8889d186b15dddcfae840edd61942198370fbdfabc94a8e48f7ff56d21ea177307bcf831a123e23149a8640f1c209d689ddc8da8bf7d7bf
- TLSH
  T1D9712D93E00DDE47F48DA97EF85FA5B52027D8C368D6D452439B89E9CC0ECBD684E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence privilege_escalation spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3
- Target
  Flowseal/general (ALT11).bat
- Size 4KB
- SHA256 e5106c0b960a7ad9ddbc6190a56caa5521510203f8eb9fa1d9bce21f9e051b0f
- MD5 c34fb5be4d7ca579b76a44c2b670b9fa
- SHA1 8e9e5b6a3fc43099c117ca3ed611d8002f03de91
- SHA512 d462228a31113d9883d4d557b220e3dbf314a16c72dd9857098700777d20cd694cb04104e1fccbeb8a3c5926544eaffca3398822fda4174532334d6e3ce724b5
- SSDEEP 96:6L67mQGB/GRRQ1z/IKdUGB/GR6Vv/GRRQuv/GR65P+RJ5+RRLxD:VmQGB/GRRGgVGB/GRKv/GRRDv/GRuP+M
- TLSH
  T16A915BA3E00DEE46F6CEB57EF85FF6A52017C8C328D6D452435B89E8CC0EDB9594A084
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral4
- Target
  Flowseal/general (ALT12).bat
- Size 4KB
- SHA256 bb2e6a96d17d44d3c502d5fc2e51a2afbb2327a836fc7085a3369a47cd6f42d6
- MD5 5e7df80caf001cfac291190a2bd147fa
- SHA1 b2b6d9c8092d54ac1c1dcc6a8d528d8909e4430c
- SHA512 6066b9a68d9c273b92c6dfa1eed6582ee648f58dd6ea34aa9f1eb80519d59856ec7cbfb051848d84ce268cb39e47e02d685257ea74410e9d2e5d37ec1b595c38
- SSDEEP 96:6L67mQGB/GRRQ1zMLIiUGB/GR6Vv/GRRQuv/GR65P+RJ5+RRLxD:VmQGB/GRRGx1GB/GRKv/GRRDv/GRuP+M
- TLSH
  T1A0815CA3E00DEE46F6CE757EF85FE6A52017C8C328D6D452435B89E8CC0EDB9594A085
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence privilege_escalation spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5
- Target
  Flowseal/general (ALT2).bat
- Size 3KB
- SHA256 91a94b2b5b85bde0c74bdeb4042350ff7539c700c53ab45a8f3e7a28212abfcc
- MD5 1a35e80e84c2c37829fc69808537899a
- SHA1 7d09d56180ee998bcc309306b5ddec33f750a868
- SHA512 9324a40a5226d724db50af5f98fee0c4fd77c68ea3f91fa1fc28f2da2aff66800916b7ed1d6c928b5d3a3db8e0dd99e5d138782b060acd72a99aa618cac65c49
- TLSH
  T18E614957E00DDE4AB68EB83FF89EE5E52017C8C35CD6C452439B89E8C84EDBE494E485
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence privilege_escalation spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral6
- Target
  Flowseal/general (ALT3).bat
- Size 3KB
- SHA256 fcc730980feee6b4b0858b30255ef269860b35688f793e40fdfebbe64eb02d67
- MD5 86b17ddbb4e6426ebbbe5ddeca1d4b44
- SHA1 2e472f1b9d465199a3e9f957dedaa1519a926f41
- SHA512 b9f73d9bedadf4fee7310f6dc83ad0b24d657a8b0585c25bd31381208b0b5308d22fbbd514d162a4b67ab871064e670501b8e8f1c1e672c5288c6f07a1799ca1
- TLSH
  T1B3719F93E00DDE47F4CDAC3EF84FA6B5601788876CD6C851539B49E8C84EDBA6D4B085
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7
- Target
  Flowseal/general (ALT4).bat
- Size 3KB
- SHA256 5d9cf257de771b34a954f654544c5d0d64a315ec0766252bc4eb4206b76b5084
- MD5 986e92161d411bff162fcaa6174243b2
- SHA1 d27937edf8811f7a93b185bcac7bbb7c5787f4e0
- SHA512 102493ec9907d29ce826d59e9d0915353d3f60d1e31def55c1f29e4f99a7fa27c4f0e0335c968c9fac79b672898e299f40efcabbf5d503f9c7e9b70575b8c9ce
- TLSH
  T143815A93E00CDE42F6CDA53EF86FA6A421279CC358D6D452439B89F8CC0ECBD584E584
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral8
- Target
  Flowseal/general (ALT5).bat
- Size 2KB
- SHA256 3c75535a30d2dc09ebf37bf2e6a52fbc61dbbeb5811b078a57172c557dee7e03
- MD5 a6d3346c9b4e34a7f4ff63f5777c0674
- SHA1 9567e03787d5ceb385b915f4c5954d2177ead01f
- SHA512 737752c2c758f4ed00dc823f297a3217a4a0942ae45c5b9e5478498f4b5b28216eb0202798442f2150ea1095ec3017132b5da3d403952ff83ff61cd61496125e
- TLSH
  T18B413987F00DDE46B48DA87EFC9AA6F5701BD8C36DE1D452539788E4C84EDAE8C4E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral9
- Target
  Flowseal/general (ALT6).bat
- Size 3KB
- SHA256 0b88d47c7a389455e31d34985604d4a87d9515028e1c72acfbfa1ad7ee3ac4fa
- MD5 5b0a26eeebd01cd8ab0f957c7a8e106e
- SHA1 0a6d6557dfb4ac03950663bdf302fe7ed45b6736
- SHA512 e6fdf74d18dfaddbce23a0c3478f47a32f1d183f8fc41cc208e7bcd078ebde1899d12e18cfdd9137499b34c15355afa44bbd6090fa1297ec2b06abd9a77a73d7
- TLSH
  T1E4613653E00DDE4AB68FB83FF85EA6E52017C8C35CD2D052539B89E8C84FDBA494E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence privilege_escalation spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10
- Target
  Flowseal/general (ALT7).bat
- Size 3KB
- SHA256 3241f3f9d89e319df5dde44e2b6c3047e5adb84d40760315e314e0bb6fd302e7
- MD5 ec26e45b3576dc503f8122e359389f3a
- SHA1 b2f2f22f66ca1a302e812fdf4175a65057e32a21
- SHA512 a7fa82ecda391dfbfd8aa11b6164cbf15e73855a5bf07228fb9d295c53ebcfb27df703a3ae6d941a1a0d57e77ea458c3c884293f06b3606940153408fc4c4dce
- TLSH
  T18E613593E00DDE46B68EB83EFC9AA5F52017C8C35CD6C462539789E8C84EDBE494E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11
- Target
  Flowseal/general (ALT8).bat
- Size 3KB
- SHA256 287063663ca6182914e01a25845603287d4696bc019c225b6c4a73df344ad343
- MD5 f94145ce1904050b4543394f4c6889bb
- SHA1 8fa16dbd1c67f8b75926494cfc08244962528d0c
- SHA512 e0f6a5436fcd9d0ac3206e386137c4dc77a50b3c775a7c65de829812f2b6cabaf5df97e07e2a14133fbc305fb04801bf2237c694dda199dce7e72b994519ce3d
- TLSH
  T191716A93E00CDE46B58CA83EF85FA6B42127DCC36CE1C452539B88F8D84EDBE584E584
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence privilege_escalation spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral12
- Target
  Flowseal/general (ALT9).bat
- Size 3KB
- SHA256 d635ec30c52bc9931ef49ecc6ea6ca13790e750b7d1b282340abcaf88336151f
- MD5 19e8dc6ffae2761cf2c54dee0cf4890f
- SHA1 dea39451f2d6e9c24f84f76fc6239951b2823973
- SHA512 083333272ded20e37101d55bb9099e1fe6cb003c3217d19f6f5a9f78ba35a4301daef188c9188abbaee755105675df094a29595ca3ec0b03d2fc9450be20cb2b
- TLSH
  T10E616B93E00DDF46B48DAC7EF89BA5B52017C8872CD6D851539789F8C44EDAE6C4F085
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral13
- Target
  Flowseal/general (FAKE TLS AUTO ALT).bat
- Size 3KB
- SHA256 05791832e32b8f5696050d894a1af712fdda750bdd1b2b54eed9f53f0e3253bf
- MD5 f3040bb7668cf8e07b528abbe7d26b29
- SHA1 cc7ad63f2326fdfe9cdb704fcf0a6100e0e82533
- SHA512 71c941e23e726d340088783eb6fc7a95361edd27995ba709849c5d23eef35d178152156399ae2f0b4bcc4d36b515c389310179d8f1d49bac3db6f5983e09cf80
- TLSH
  T10E715F97E00DDE47F68D643EFC5FA6A52127C8832CD1C851439B84E8D84EDBE5D4E584
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral14
- Target
  Flowseal/general (FAKE TLS AUTO ALT2).bat
- Size 4KB
- SHA256 8c196130eec5a8c5304319dd644ebbd949435cce670c8575f889e2b8542a9b8e
- MD5 ec7eaf9ecaea194bc55ab477d3ae93ea
- SHA1 28ebaaef93d3ecc74d1d9e3f4cbd09d20f8aa2e5
- SHA512 c1b751ffc95fb180d4409b61ddf05adf1e88ee023d5b4306d7986f5455aca119b498428e323e87c06d18539aa546a480138832713570807955073a7f21c248d5
- SSDEEP 96:6L67mQGB/GRRQ1zdDUGB/GRdVv/GRRQuv/GRd5P+Rv5+RRLxB:VmQGB/GRRGdYGB/GR3v/GRRDv/GR3P+k
- TLSH
  T179918B93E00DDE4BF7CEB43EF85FB2A5201798C36CD2D452839B45E8D84EDB9594A190
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral15
- Target
  Flowseal/general (FAKE TLS AUTO ALT3).bat
- Size 4KB
- SHA256 928178e6df21c9d149749ddde71e50f171fbb88ede2a33f5421aa2386d428411
- MD5 7788d6b1820d9adaf378da0c9214fbc3
- SHA1 c5a41bffde3985e1265882811f6214770dc47801
- SHA512 4360471de322a73bd046af6fd9b5599cf3ea6f18e559ef97fa84a3009e7f898aee17588432df0370c3bfcd003de9c6f10af5e985ae4ee8843c156ffc260e0e1d
- SSDEEP 96:6L67mQGB/GRRQ1zp1UGB/GRPVv/GRRQuv/GRP5P+RQ5+RRLxE:VmQGB/GRRGpmGB/GR9v/GRRDv/GRxP+o
- TLSH
  T142815C93E00DEE4BB6CE743EF85EB6A56017C8C36CD6D452839B85E8C84EDB95D4A080
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence privilege_escalation spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral16
- Target
  Flowseal/general (FAKE TLS AUTO).bat
- Size 3KB
- SHA256 e04291bc62728ac3d8daafab5355f800bb98a040a70ad416aae124e53da03178
- MD5 142bdd21af782c7ed929fe848e651d05
- SHA1 068f30f52eda246733de7053175b8c77de8c4dd4
- SHA512 7a98f18d093e2189ea2693ad77417ecd3f3be74316757d819617220dd9bece38985e7da89b34e48010c2413b46abe872543f5a5f3143d0d9b411e4c9fc757e40
- TLSH
  T172815D93E00DDE47F5CDB83EF86F76A821279C8328D5D852839A85E8DC4DDBE594B084
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence privilege_escalation spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17
- Target
  Flowseal/general (SIMPLE FAKE ALT).bat
- Size 3KB
- SHA256 e90f5b07e8e3053fca917477d8ff73207704a2f3a694cd6d829355a3d51532c7
- MD5 9dd95a9cc728f5e20cd4c0ddb3a781c4
- SHA1 b5a86d73d71626efe6a8221cff32e2ded01434c6
- SHA512 84eeaa8490fb9976098b106d11bc229a609eaf59e318a3e51b5ff509214295002cb3140e460c66a725e51ab30ca0ddbdce43693c54cd465c202fb918bf0292a5
- TLSH
  T100715A93E00CDE43F58DA43EF8AFA6A42127D8C319D6D452439B89F8DC0ECBE584E594
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence privilege_escalation spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral18
- Target
  Flowseal/general (SIMPLE FAKE ALT2).bat
- Size 3KB
- SHA256 c069498b8d12f85141128ff4765bf45859502c78e50a6854811d08277ceb454a
- MD5 e0d7677f613c2fcd993571cde19353a9
- SHA1 6caa7573868d7fffd1f47c118004207aa05a52b7
- SHA512 2f8a510cd2619074c1f7a912b52ce4d77bed1df980c0725e4fb1a7b4560b0bbcea91cdcac2e9f01097cbd44812d663c7cee0afefd4e0fd6c983ad5408b14fd3c
- TLSH
  T1D1710B93E00DEE46F48DA97EF85FA5B52027D88368D6D452435B89E9CC0ECBE684E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence privilege_escalation spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral19
- Target
  Flowseal/general (SIMPLE FAKE).bat
- Size 3KB
- SHA256 86ffa23dc254de623a9a4bf6cb51011fc25d38295c55a2314732bf14887c4640
- MD5 bdd2bdbc394724b558b8d4c8a045a53a
- SHA1 a733aef3a35e6dbfb0914d333ed9d9f03444f654
- SHA512 f94458464ccc74ee99b41228b093b4e6b2926c895edb4a86f05adcf573987173e717ba66a5506d7df9643bdab591c63b008e434526e3138569412431e21c7475
- TLSH
  T196712B93E00CDE47F48DA97EF89EA5B52127D8C368D6D452435B89F8CC0ECBD684E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence privilege_escalation spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral20
- Target
  Flowseal/general.bat
- Size 3KB
- SHA256 71e46d61867a6f87a7a951c435b116b93553455e0346fd1ab7ee6a0b39336da3
- MD5 d2b521ddb2a0c9445937c31e72c31e23
- SHA1 e361297f359f9f8dd1d7c29f8158eee6bcb2d1c6
- SHA512 0170c1986c675980d02cfa37bbdaef241781ee8d4168a215b285471438ad9dd9c269dbff084ff086f620782fe82fe8a93c8728a077de17fb91eef9a0f31bcaf5
- TLSH
  T103615B97E00DDE4AB68E787FF84EA6E12017C8C35CD2D452539789E8C84EDBE4D4E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral21
- Target
  Flowseal/lists/ipset-all.txt
- Size 18B
- SHA256 19123a22bf1108815c07bda3cda8df282b30bd63e4939949928969c0fd195873
- MD5 42ad35639873f78e1b2dc5c1039499df
- SHA1 0fe009c7e4f670e759fda4668a8b37904215c9fa
- SHA512 1676acc285990e44eb382705e0711fcab7fac79348c541c67bee58a49f3223d8fc61dcb895a7d2dc25ff38dec249268aa64e50c952a214f264b5430f9726a907
- MD5 SHA1 SHA512
Score

3^/10
behavioral22
- Target
  Flowseal/lists/ipset-all.txt.backup
- Size 513KB
- SHA256 1fb91430a8594b2632d41a87b5bf071ce851ffb5b4d470b965d1db2b60d3ee94
- MD5 159fbec389464bf9d2719641f9f5e0cc
- SHA1 75374875a220cd3a9dda7db00cfd8fe1bb474fc2
- SHA512 9d2dfcf79de4ce4caff1343bb7a11721b2a4bd4239eed745d1d16290e8762fd28b152e54792317ee9b9c2bc4c9c783d07312e8674242120b623f97efafdb69e2
- SSDEEP 1536:yRVsx0/6EWkNeuDC3BByxwKVHoTORc/47mDgTIgmKI+5o3eho4nn2O/LxqVd5+Ap:sdTIgmKI+5oQbnY
- TLSH
  T17CB45F7132BE5EF09581B3EA23DB81647AFBE1C634F6F2608B4FA57129220417D59D23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23
- Target
  Flowseal/lists/ipset-exclude.txt
- Size 135B
- SHA256 96c03954012765ce4ab03b9c30f29ab1ca1b698c6752224d03828e6d182eb0fc
- MD5 240532f20e114cd6de2906ebc86d683e
- SHA1 f7d4b6e1ec084e64c367ac11f5fe21fff454fb68
- SHA512 809e9961b2952acff12fb27b31895f9e7c0d70433363cdd8fd61bd522ffa835e7d403de3419092145673e10644aa0803d0e244d9cfff8d8bf784e783713f799a
- TLSH
  T147C09271516912FB0F876B21A13E0326F9475BCB26F37D64A36C5286EC504096029920
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral24
- Target
  Flowseal/lists/list-exclude.txt
- Size 1KB
- SHA256 fee10780709c1956046e2f300af46cb9814c23a14001dee85fe5149e1f286f5f
- MD5 e8efd7d8469ee49a20c0bb02d5830538
- SHA1 e7e6fd4541367eb40c63efe82fa66ae515681904
- SHA512 9f865b6c33f3f62e639f2f6b9e7809c2d90ba1f6c44d8d363b65eac62e2e7b4435914e664b0f4b12f57474b99d4172e96f543ceab609c5d2ae75049c7210c2a4
- TLSH
  T1E731DFB0D84024505698F48BD4A67F44A839323A81C0ECC667E8DC8C23C32957FCFA71
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25
- Target
  Flowseal/lists/list-general.txt
- Size 886B
- SHA256 fa32857695c52544c082df680807564d24c360be6eb7553f8d5fac6591312f6c
- MD5 8594722ac5b56b8742dc743b572ed22e
- SHA1 9ec8968e9c5e2e281685346b251833ce43b688a7
- SHA512 eff58658642bf890459051ad0eefda677f7561f8b92193957592153a2d114e14a010659e498c63b690cf930d051490794e964ca9c91e93c731dce673083c6dd9
- TLSH
  T1FB11FE53A1A997502B1ED4E8145462A02394B4F11CCFE2E39B6FC19F09093FAB3C0EA7
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral26
- Target
  Flowseal/lists/list-google.txt
- Size 414B
- SHA256 1e59f9d487f7bce12091c838151713d0a8d31c3aae20afefebb38206f2cd8232
- MD5 a47c9cc57d60596de04f785df7384fb3
- SHA1 91fd0465aae6fc84a0164531bc08683e67f57aba
- SHA512 739d2a53cbe969e675d37a63dead91fc68278861fe2948e65300bd61bfaf95758cd83fa52493456746cb6aaff09705bfd35050875cbf5b57a110e41fb38c7dc4
- TLSH
  T1F7E04F87780E809F4202ECC818F0654DB62CF23586DEEAF4DD61D03E70ADB4A34C18E2
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27
- Target
  Flowseal/service.bat
- Size 29KB
- SHA256 044463b76875eab318e56b9dcb7e9d342f6ea56ed0caff9b854195bee5a488b8
- MD5 b2abc7d0ebd2833dbebe7729797450f2
- SHA1 127f3948b82b98e0af98355d053d703024c23a30
- SHA512 bf1e591180bbe1535fc1c6412c80bc02aa83df9a1e46d078944b98a9b37ea3a643e7c2350f2e13348d83d21ac3b45d4db3a5011ceb96490dbfb14119f8d3a1dd
- SSDEEP 384:QvzkC5RCE3utFcIuVMxe8AIKoPamn+CtIajLLjCXpEakDi5h6wUEz+omf0fOQwG5:QvzkC5tVGKWaYw1hiMMKcc
- TLSH
  T194D2612B1402586608B153B3D92640E1F75A81D30B3176DE38AEC198BF7A76395FF6EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery execution salatstealer spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral28
- Target
  Flowseal/utils/check_updates.enabled
- Size 9B
- SHA256 c823a2779ca11474ada5ece9c37cc825f71c54fbc1525d9b0cf3dbc7879abb09
- MD5 c45d8fbde4e335ed2d438d81bf5e6b5d
- SHA1 c78adef3e4f3601b3bfcab9d16467709e4242f13
- SHA512 6a3f31efd1d6c20ca61c515cda8e13d684a87cafb2b8ed940b24fe5d195c14c9b159af906d6dbad7e2befdfa75c311a96f792e342aadb2e0be15c7fe148d83f0
- MD5 SHA1 SHA512
Score

3^/10
behavioral29
- Target
  Flowseal/utils/targets.txt
- Size 1KB
- SHA256 4c953196e2649478c267450fc80cef121ef96bc50656ef75336b9589c0808cea
- MD5 0260e9fef4eaf980bda2c0118c2693e1
- SHA1 90a1202ac88ed738059639a7925be7fe1c7d34ed
- SHA512 845f2be911a0f51aa10fc0c9417f8cf0e06015cf5b87d02c686e02b3af15f89b81e8163ee1185e571f13a6e908d08ab211587397840219699ab893d18ff8d57c
- TLSH
  T19C219B93F152C4B0025A84DCE400B2ACFB0A411F678A60EBF04F509F3B047F482FB696
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral30
- Target
  Flowseal/utils/test zapret.ps1
- Size 38KB
- SHA256 f31ced248fee999c780d1361d2a244ff2a63c7feb57f5678176367ef5d2b0e15
- MD5 82c0648c9e124331bb53a8bef9555492
- SHA1 4c7d3f3a50a15c8d3bf4176186ca5554971056c9
- SHA512 0d73dbaf63a0ae0c2edccde6fbcf2a4855d98bc1c13784cdbd7538e3b113190f187b232bda7b82b1c2a9d69244c388c2a500f92c9ccc5089640312c54762a599
- SSDEEP 384:jAakddb1Xz1jbdZxP//nnXVqcNm5tVZuyci8EULNW2pyBw61H1UVnVd8QGeSH9Yz:jzk3xXFc5tHtciOswyBw61H1Kd8auA
- TLSH
  T1DD03B72AB90A106A52735BBF9C416104FF57417B800D16D0BD9CA0D87FF492ECA79EEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral31
- Target
  Flowseal/wso.exe
- Size 713KB
- SHA256 3493b52c5af7c4e66a28ee1968be3d39dd7c8261b940fa0735f3740435886f48
- MD5 fe7e22f45f15287ccb30f823fb7b6811
- SHA1 066943c19f164aa20d9258b84b244af4a36e89bb
- SHA512 56b740ad11d1c94f56409476ac2b5c66cc889454d260bd8bb1373d2a6e0a03cdd08e98a80eaa61c0ccab00e1b638745e8594873a307c96ea4807c83705ba6faf
- SSDEEP 12288:fUHfP9ZMbthvWQpvkQV28GiINs0pfebZAjU3dDFX34NG0LyetF9oTakftkQlBN1U:fUHfP92zvWQpvkQwPu0JwWQ3xFYierGo
- TLSH
  T1A5F4AF941CB39E5AED6AC6BA9F8DCD3439C9A0FE133325964A2E1993D1D50C0F5381F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32