salatstealer | 54318713f5975fe0565cb90fcbf688bd40473d50b0abe26dbda0d01a62ea2383

Sharing

Copy URL Twitter E-mail

General

Target
Xeno-Tool-For-Roblox-Version-Main.zip
Size 1.7MB
Sample260716-nbdwrafs2s
SHA256 54318713f5975fe0565cb90fcbf688bd40473d50b0abe26dbda0d01a62ea2383
MD5 a400b692cd4b6db1231c464d057d7b2f
SHA1 3e5c7d26c0e1e43e07ce2c3c2b0064e794ea1fac
SHA512 32b031cd6b005e733478b1e1db7c2eabb64a2b2e71b9c40b8bd299c8a49e4ada3202a92e6028c83da49edacbdd9222f30b30efe88230854ec0c734bb5f0c4338
SSDEEP 49152:+8MdVVF7gREnO/lZt360ducCSLJphcbYLnNoB:+8CV3sEnO/ku++hQYTNoB
TLSH
T11585339DE700B9BBF44D03B2EF04964964C862BDEB1D2A5F1890772197C1383ABD9CD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Xeno-Tool-For-Roblox-Version-Main/LeadD3DXenonR.dll
- Size 330KB
- SHA256 3a1964e793755ff1e1801570894af1db52826c7a9d0474c22c995b2abf2748aa
- MD5 cd890acfb3e6c412900c619c6d6ad523
- SHA1 897f66ec8eb7d53a631bf3215a350db86720585d
- SHA512 b7e0d8b54bc15db765465c16363aa7d5bd82e49e5acee82b0c2ddf5f79685df65e40d94a812840ef1cc717dd2a820f6735ea528666dc5b17a4db87dab2e63e5d
- SSDEEP 6144:8+e3WX1y6T77aTf/kZHRQRbBgVF9AOmg+k2QG:8HywG74XkZyl69US2QG
- TLSH
  T1ED74BF50B3A3C072C4B91271441AE7766FB97635076899F7ABE01B6D5F223E09F32386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1
- Target
  Xeno-Tool-For-Roblox-Version-Main/Xenons.exe
- Size 389KB
- SHA256 014b894eafc577d24b7c7794cc36995575e2012f6ba52ff6fa93ca0d0dd0724e
- MD5 52e3e8a125e0d4622af567add2c3f513
- SHA1 a398bd236092db4a426747369ac06caa878472a7
- SHA512 3d5b4a277d9c71b3682b10231501fba2d96b2d5e0df8f701359f9bf1d630c70a2516a5eefc15f9db1e2b44891ef37f3f78eef2ac10a829f4e27956929b9f0d5a
- SSDEEP 6144:l/OnI0EB2bE0Rtth+X5lHdyxXVgajyEomhEZTVtUy3/nOu:Ma2bvM5l4gaijjtUy/
- TLSH
  T1DB847D1AFA6404FDD167D178C9624906FB727C8E03606ACF23A059A75F376E49E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution salatstealer persistence stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2
- Target
  Xeno-Tool-For-Roblox-Version-Main/data/CvGameDatabase_FinalRelease.dll
- Size 613KB
- SHA256 e5e0334d92f92b68e4eb566813bdcd16a1311c7f34e7062cee19fb3aa2fe52ab
- MD5 d4eebf951bedcc023b46d9416eb4b91c
- SHA1 c7eacb679bfe4d4f6cf6af5761bdb0f2879e042f
- SHA512 be6219583ab3bf8e38237395135bd05186057745a2228b5e6fae6e07d04aa40a074d23d4d8ab5c1010badef24ed637ddb292a860c144dd093b5b812a41b09a2c
- SSDEEP 12288:/1OHGP9/GLvGH0vObA1wmE+O2aS5vVBRFYSv/4ogCT8Ncj6AtoH3xR5z:dOi9/GLvGU281ROoPv/bgCTxmAOH3d
- TLSH
  T1F7D47C22BA918031E8D611B2E3BE1F762D3D5915133895E79BD868D0EA344E3777F30A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  Xeno-Tool-For-Roblox-Version-Main/data/NlsData000a.dll
- Size 829KB
- SHA256 55a971f22108b4c467c16da210f5cf39e5f6df2515c53342db79893cfaddc5bf
- MD5 0d020fda9520f84b83271c63f0def06e
- SHA1 65d7cb051560d7f153dbae6c784005b5cacf98b9
- SHA512 6620b7974b6d17e0ad7da667db7fa945aebe0e763699fa6aea97d0eca71e1fa19e867325eadabd79c3b693254395ccb16eacf7dfc582e720a796259873970311
- SSDEEP 6144:rvEFdO/nuxvCPGwnB/Vw8zyxViOnr//4fsR2EgC5wCGX7lFa9j2AMAtW/o8hcbme:rvWO86PtMm0Grl04kPhLzIGwOdk6
- TLSH
  T185051051AC0B6F32C7635B23F1E32A018E7D8597DAC809E7A52F7C2498973957A73027
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Xeno-Tool-For-Roblox-Version-Main/data/NlsData000c.dll
- Size 608KB
- SHA256 7a0094a4ac78b7aa233db3193c867239aa777ccf1a68863097192ad4612304fe
- MD5 debebb099e796aee937b9e5de98d048b
- SHA1 042acc55abadaad793279216bea622a87acec43c
- SHA512 451936c29e772c6f29b8508ec0477236e8e47a601ca9633e0840dd8f76a9369b92e71db56de5143d50d4f0a0e6211f0730b4178267b361a61a9036d4a3444633
- SSDEEP 6144:fX9R1UJWpPM8SD0s8RLC3qM2z6mcnRqQsTdyafGmn6rfyw2+Q1N:/9RiCLRLC3qM2z6mcnRPsTdXHnqfE+
- TLSH
  T165D4E51C7DD1BF65FB9FD13980393B7CC1EB8510D7816A7EA25EC51921A818EAC8620F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  Xeno-Tool-For-Roblox-Version-Main/data/NlsData000d.dll
- Size 674KB
- SHA256 3af3d13b87122bd05eab3f603a02f8c4f66aca2ef0afff175ed0ca9c169b36cc
- MD5 d7c04812885c5640a835209d13d9f6c9
- SHA1 39e99afa35f8d9be1377bafc1373f19b6d37d38d
- SHA512 dea24036c3e1d61292f7eaf731763d82e6d797ffc846c0e61572728a6715cb09546a30e522e7c699383bf7a531cbd1f3232823b48cbb7e1043878f5900a0b664
- SSDEEP 6144:cuIEOzH0uMglTfrcvDD9c88885EHZI0WR/wOhle7G23GB7mI:cuIEOoJgFjcfeEHSR/wCkT4mI
- TLSH
  T1A9E41861BF129134F7CFFE33847F2F6CA3674120CBA526AB51E8C456091A2BE55E4623
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  Xeno-Tool-For-Roblox-Version-Main/data/NlsData001b.dll
- Size 771KB
- SHA256 a9f78cddc0a1f9439c1ec458053e57445eadb6942c60363d5d27d8b173c65d10
- MD5 b4819575c40c63c040bc63d883ebb336
- SHA1 efdb08a5f7f90d59b6ef6a792a6d301efcd76e72
- SHA512 bc405aedf156002e17d76c64bc0da8d2242aa0134b4a1fd390db72cc6ec10e358576285b804015c79ff7854878bd97c05c03d47904a2f2f80ef7d72d4b665b9d
- SSDEEP 6144:Zju7YZ+tveU0soztKDg4fg6tlSD3ibijaKKKKKK+KKKKgCHrEhGzRFkN18EhbenO:ZKPGU0slTfhoj8CHlRFkJh6RIdh
- TLSH
  T114F438F4BE259839E3BBC07081BC6BD0F49BC0E49754109B66DACC76C4487D965AB23B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  Xeno-Tool-For-Roblox-Version-Main/data/NlsData0022.dll
- Size 918KB
- SHA256 5eafc9c7ca9cedb2b7c4502d9d7f2349a8180d51b7407846af98fa8cda0663a0
- MD5 df6d317c538cf2cb6efeb8837de8a655
- SHA1 6d6fc8f60c95d8c873046c578ecfa372754873c9
- SHA512 496417428d631dc4a29a40f639591dfe3d9c4832bca73d5b8c83bebf7ffa4dcdfbb7c6065db68089fd73c56ed30d7be59ca7fcf2789b27b4840606ebad553938
- SSDEEP 12288:NWaaQfGIo6ozbGLHkU3+HTuWhruHRGk0ZP4p3xEjX+:NXrfGIo6UCLHkU7WhruHDTmj
- TLSH
  T12515B3E5ECDAF235E3EA8533953C66344257E11687A2918B61DFC6B8864C2CDC0DB31B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  Xeno-Tool-For-Roblox-Version-Main/lib/config/RjvMDMConfig.dll
- Size 70KB
- SHA256 ca829773bf2e56de3356a43d222a8fea0db95088ae9ed5a0da0d720b0e81ae35
- MD5 1393feb2072778bcbe3b3b8bce66d79d
- SHA1 a4b5512a90b4ded21f52559b64eb1658f596f8e4
- SHA512 027df5a337be68be823378be46a2b91bff6dbd40051a7196bc3f5cfe960ded42050a86df783104ee70757ed785463b6acea369390edbcf5426f8c4f9bc743e9d
- SSDEEP 1536:+aGCqEekCqEeHYnPtOe8TNThtS1MT43WlnpJ2qD4:yKekKeHTc1MT43opIqD4
- TLSH
  T16463192137E04172F8F6567895BE15366AAAB424EBF245C7752F23EDD770AC0A938303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  Xeno-Tool-For-Roblox-Version-Main/lib/libexpatw.dll
- Size 140KB
- SHA256 e3a27b372d3d7ae7b13e47e5f760808af99d0960873f62705a37efd01aaedcff
- MD5 41813f05f1babc907640550d1c41b456
- SHA1 ddd20043a06e36caa7dce8575cdeb52ac4d2cdf7
- SHA512 0de1f6eebe3d61426eeab4c05bd7d883f8884cd71dc2af466dc583149d6b5f20bfd05057ccdeb717b7ec6fdad5a1a12cb963d6ac8a9621478ad1f5bb378c8594
- SSDEEP 3072:Lmys9X5hM6ko7yMD7D1w+Nq5YfDm3KLqKLRHDIOdHS:Lm/M64Mf+MqCfDm3KLqKqOdy
- TLSH
  T152E34856B6C3C0BAD5C5103D112913A39A366B6103FFCDD7AE80B9AEDE336D16939381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10