salatstealer | 157365d292da5d243e852444596fe55dac2aa59710c6cb3eda006394aa6b4ea6

Sharing

Copy URL Twitter E-mail

General

Target
EXITLAG_PATCHER_V1.4.4.zip
Size 84.3MB
Sample260716-cn9y6sbs8j
SHA256 157365d292da5d243e852444596fe55dac2aa59710c6cb3eda006394aa6b4ea6
MD5 d18a66fe2f7f207ee2e85503f3107c0b
SHA1 5470db98fd078349b5342f58aa223535b8c8fd4c
SHA512 937fd7a0c95383265fbbbcab7872f68d4d3428cbabe0df5bc88d9fc6edf965273d8c1362ca1f04864e903e448338b28db5a8754be803217f48ba2c4d562cc041
SSDEEP 1572864:vH1CVcU9/QYs0uMZaBzDxfVrtYRQPn28t+E1x/oNOTED9URr3edd2OsUr:9NkoYs0ul99V52QuhEUOu9URKd1r
TLSH
T1A018330412D7BB7FFE6FB1C2A835676E9045B620BBF2864A32C5F0D79179A76EC54800
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  EXITLAG_PATCHER_V1.4.4.zip
- Size 84.3MB
- SHA256 157365d292da5d243e852444596fe55dac2aa59710c6cb3eda006394aa6b4ea6
- MD5 d18a66fe2f7f207ee2e85503f3107c0b
- SHA1 5470db98fd078349b5342f58aa223535b8c8fd4c
- SHA512 937fd7a0c95383265fbbbcab7872f68d4d3428cbabe0df5bc88d9fc6edf965273d8c1362ca1f04864e903e448338b28db5a8754be803217f48ba2c4d562cc041
- SSDEEP 1572864:vH1CVcU9/QYs0uMZaBzDxfVrtYRQPn28t+E1x/oNOTED9URr3edd2OsUr:9NkoYs0ul99V52QuhEUOu9URKd1r
- TLSH
  T1A018330412D7BB7FFE6FB1C2A835676E9045B620BBF2864A32C5F0D79179A76EC54800
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery salatstealer persistence spyware stealer trojan upx adware ransomware
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  EXITLAG_PATCHER_V1.4.4/Exception.bat
- Size 2KB
- SHA256 2bed3b796935d8113797e9a76ba43968158556f8ccc23dc2935e69d16f865d07
- MD5 0ab56b5c409e4fb2ae123b07495db692
- SHA1 735aa90cafb5d4df5c82f89e214b1dcccc151701
- SHA512 34325775277d1596e2c61597464f5feca5885eeecebba96396d1fec83196a27328276bacf7ed9c9f25460b5680b31a085f3cccd75ea5a12645fcb8cddde119f6
- MD5 SHA1 SHA512
Score

1^/10
behavioral3 behavioral4
- Target
  EXITLAG_PATCHER_V1.4.4/ExitLagCrackV1.4.4.exe
- Size 43.1MB
- SHA256 b03e9657b6d14754a89b519aa07388ac95e61258c217edad4adf68a5ba2488e1
- MD5 d6854ff81eb19f1ef11e925f5fcb57b3
- SHA1 ea50e9ff809389106a2640c8882f8ffe060d490d
- SHA512 5d29371f5cd2bedf8d2f2db493278d0202ba2fd1c9a55a1e9f26105fe5bb6feb07e43fac523d0cf962ef1dbdcbe42694417b3d953a5b4ff5dc54c8ec7f5854ba
- SSDEEP 393216:2xk/94JcO6+MTevLSYhL6rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrM:Ck/94x6hTM
- TLSH
  T1F0A733999141EA37C87BB1784B46CA5F2E91EB284735E4C2E77780BAF9F165CC801F42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery salatstealer persistence spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  EXITLAG_PATCHER_V1.4.4/FirstStart.exe
- Size 43.1MB
- SHA256 b03e9657b6d14754a89b519aa07388ac95e61258c217edad4adf68a5ba2488e1
- MD5 d6854ff81eb19f1ef11e925f5fcb57b3
- SHA1 ea50e9ff809389106a2640c8882f8ffe060d490d
- SHA512 5d29371f5cd2bedf8d2f2db493278d0202ba2fd1c9a55a1e9f26105fe5bb6feb07e43fac523d0cf962ef1dbdcbe42694417b3d953a5b4ff5dc54c8ec7f5854ba
- SSDEEP 393216:2xk/94JcO6+MTevLSYhL6rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrM:Ck/94x6hTM
- TLSH
  T1F0A733999141EA37C87BB1784B46CA5F2E91EB284735E4C2E77780BAF9F165CC801F42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery salatstealer persistence spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7 behavioral8
- Target
  EXITLAG_PATCHER_V1.4.4/Slow.dll
- Size 2.4MB
- SHA256 0af01a041bab068a2ff67efe46663cf16a32cf1bd9b9c525fc4deb68a64a4b9d
- MD5 bb2fbda4dbb2b31583f560f3632db668
- SHA1 7259d976ae572940f1b1fba966b69e446f91ad97
- SHA512 931fac844204a282033d5990b58f9880bc85818d715c5983f57635aeb46feb72b8c938398201ddb740f693228df8957b1c5553c3005f85f2ee3523e84e263ef1
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  EXITLAG_PATCHER_V1.4.4/api.dll
- Size 109KB
- SHA256 9486d2b0ea8c078caa2f2037dca0adfaecb163ad11c5fb901216195cb931547f
- MD5 67ab7afe9b79924535fd9c79b061ba87
- SHA1 cb3bd6c8a8d9373f76042c46b81d16f9959365a2
- SHA512 b8d4ad5cb40d4ae99208047b77ebc06515cde0a17e4441ea9cb98062167aae3cf0d03e6b66a8bd41d72352eaf58c0b6cbc0601614f9908a2cae87c22cd82abb9
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  EXITLAG_PATCHER_V1.4.4/config.db
- Size 73KB
- SHA256 06da35fdfe464d39d3994ecdfa367195c2b3453ccb33acef1390c2d9d0d09c27
- MD5 446aab569d342a7b51bc0804422f3d23
- SHA1 c5b361333a7c74c1d1835161a5cf3faa77b10d54
- SHA512 f3d1b0d8ae938df7a5e63c603b1bf3ddd6fadf749c3df46b89c6908ee7782f7da464fb9e20df0ed57843bf6633cac6389ac09262b1e2fd73cb1cf4d3ebbc4d9f
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13 behavioral14
- Target
  EXITLAG_PATCHER_V1.4.4/definitions2.bin
- Size 1.8MB
- SHA256 3da83bf8a0b9ce69e1659be775a7581ff1cd6ee7745a562b9bf0b2d347a9b009
- MD5 c2c8a9d4d3f2d44a50ec1ff682838cc3
- SHA1 532a8c11e770c5da8927e5b5bd257bc59a857e0e
- SHA512 e5ba3887c75521832c15c772141c23155dbe85979f34f152e5c7b812d489fb212725b2a577239d8ab372df60ea6c51ef0968d185b394eda8b0c29a43bc820935
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  EXITLAG_PATCHER_V1.4.4/ibcrypto-3-x64.dll
- Size 4.5MB
- SHA256 2095ce1ccb2466dbfc11800544beea7aa85f00e76eb0f346d8a5aeac06878906
- MD5 9daca73976f2f37fece7f1627ebdb1cf
- SHA1 c3f74be041c13211b49751373b07baef08e5db33
- SHA512 fcb6acc83271c49da1bb3014bdf57d8967b3ac669efb38c4bb9ac290b85535475ceeb3f1c21c792cea67443d564114a0acfb9f9309e41cbf3f31e304cb55964b
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  EXITLAG_PATCHER_V1.4.4/libcurl.dll
- Size 558KB
- SHA256 3a692cb9aa8f671df2cc520a18fd07a3817ab39861ffd047804d913d91e5cf7f
- MD5 5b5af4f21483b8f6105eab1a004dccd1
- SHA1 eeaeade8fda5e65fffd9a63559c59090b49fae48
- SHA512 3b4f5c241543dfbb137fa71d7a930ef8a20da3f29733da69777be9128f4dd69c10adcdf16f6ed594533ab99203532ab9f1fd3196ea6270c780c401719389d096
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  EXITLAG_PATCHER_V1.4.4/sqlite3.dll
- Size 1.5MB
- SHA256 106f0647ae10a6516b1ab2968038161e287ef40d1b22ca047531ed768e594ef1
- MD5 6811c482ead27c0b1165ecfbe996c2b4
- SHA1 95823c334fce55968e8d2827ccd1cf77cee19abd
- SHA512 ab01935f9738a15aa75ad0bdb72afabf3b0b0c1fc187c0717edbc5ef93b45f837ce74d60ee53c309df65a6de71fe5993c1fab9b5d21fa6aae6f306e45a1d3913
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  EXITLAG_PATCHER_V1.4.4/zlib1.dll
- Size 89KB
- SHA256 f3de06fbf79bc8b12bf6d1967208277e63d54b419b01271fc59c2db053956fda
- MD5 59b290b672428a65e32ed0b5ed79fe41
- SHA1 38268fdcc6020d1776631d8918a4992531b75369
- SHA512 0c0afa11e9f75025088948ea673304fb5bec3c9e40c1d665cdc14da0d500dfc15ba16a3174074ce02477555ed4942b72d2d015bc2152615aeaab48c392050955
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24