salatstealer | 5252c0629e843a5d14ca73a564360f9a5ca1fff872a64a56ac20e08b5f942055

Sharing

Copy URL Twitter E-mail

General

Target
Velocity.zip
Size 79.1MB
Sample260716-rn2ecsbs6y
SHA256 5252c0629e843a5d14ca73a564360f9a5ca1fff872a64a56ac20e08b5f942055
MD5 cecfab81846c0485b7528cfbcb663ef8
SHA1 176dee7f9bb913d67cf9b0c8647fb3d6993766d1
SHA512 63e197b1b4b5a7a5a2a51ef7d3fa361907f41b644629797d40bc6bc3dfb1a5f3fabe6d675975b862c757a665d69eb98008823623a5b2349afd69e964f14c5a38
SSDEEP 1572864:7Sg5y39vfCOZcdp+MhPhldgi5h135+8gSYeBNw/9n2PfyW7PGFwZXmgm2U:bW5tWlhPzUeBoZoyW7PGaZ30
TLSH
T1D008337E0ED18D53E97138EEDBA7CB2732901AAC10611D4C9B18B60DDD76BE2106DF29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Velocity/Bin/Decompiler.exe
- Size 9.4MB
- SHA256 fb5c5e11296f8cd6b552aa03daf760d99a380077ff92ba657d4d956af5f3d0f8
- MD5 a109790efbe0542dddf63ef0415dd508
- SHA1 34d3f0c57dd5359f21bee246e00ee01f69132678
- SHA512 a148f1b6a5423147651ab12fad0250ff000efb605e7d468fa45d1e1c1bba71bf2748741d9e62aa72228b9e674d3766d736df64e81b85c9d441e840e0bed75d7f
- SSDEEP 49152:AhW7+AqGnMYHZi0h/tipa/lZ9dco869rpyd8cuIhwSt+AOaQXkiShcwaPJXqlExR:UkDPUKXmtGYGz2YhN
- TLSH
  T124A6C62A676960D9C1BFC07892839F22BD21749D073977F7898182692F20EF87D3D764
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Velocity/Bin/Monaco Editor/Index.html
- Size 322KB
- SHA256 f594177a1d87c2caaab344207dabb21cd044e1bfac5dbcb9cc4dec7cd4337642
- MD5 c6d8268b090b11d1cb06a924969f3033
- SHA1 fd9d1c74ecb6a3e4929b96ce1f6a587a3cc3ec57
- SHA512 dcb5fdd63172688d29bed31685b5a9bf811ab4e85bd8328ea1028298ceeab172f3b632985f94d5babd2ae8e5471999128ff721a61a892c72857d4e4eb59f9b01
- SSDEEP 6144:ujW4GZWXmponRPOVT5lFeicvmSA+HncLFhNyePWPkvU+OI7a5OT9l8pVp1fbl2Gg:ujgqoA6wfpI
- TLSH
  T1AA64100EF1251C1126876230669BBA18767044A3AD667F063FACD7142F9D29F61BB3FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral2
- Target
  Velocity/Bin/Monaco Editor/vs/base/worker/workerMain.js
- Size 133KB
- SHA256 b19ada1ffe036707eecf00f4e1bc0e3c4c6ab546fb7e5d4d52f5a62de4caf0d6
- MD5 b838e4d4ca3a40a357225bd920ade768
- SHA1 4108724d46fac36b42521b70c99cc6a3ac32e2d2
- SHA512 9d689e2be1cfc52444d22ffc590efb5ff2fd9ead6ef7f01323b57156365eff7b4f31c3a0b9e97872844373791ba40384f768f4f2655a75f37d0a5f2da74cfe46
- SSDEEP 3072:W1DOqzYJv4cw7ktL4JqX8PPiz93don3F9s:gDOqzYJv4cw7gL4JqX8PsI16
- TLSH
  T156D3C5CD72A5B4125397A1B1507F120FF33A296A980D44BCF365C8DD2DBA48A617BF38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  Velocity/Bin/Monaco Editor/vs/basic-languages/lua/lua.js
- Size 4KB
- SHA256 4ea76aa12e7e1072dd553b93e0c17b34b6d11a28640ce0dad2d193f75e940ba7
- MD5 ee5ad27a99a4740d57fb4382b93115ff
- SHA1 63cd68497ea351005a3b73db40ea0f031de9fd6f
- SHA512 b915885921c5cd783f7061a153d476521b8b0ba6da4bf14b67fabedd973d46affd40afd8419d56e991f54eecfbb9ae8ed9da2cb5074bcfc5b149c1350111982a
- SSDEEP 96:SD3OXPlI+iI+6OOfCDv9VtKI9fTxdeT2Nhq6i+G/uMB:jXtI1I+7DVVtKI9X6y7G1
- TLSH
  T130913FC2CD8CE25E8BF5F7848EDEA0E6F58D4236C43516BAFED0455C160CA88865E735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  Velocity/Bin/Monaco Editor/vs/editor/editor.main.js
- Size 4.1MB
- SHA256 d0bdfb6772eb44d719f442d22e2849010da23b684c1d44073356c253f9e6c392
- MD5 1c1273a4e17674191aeb9ba244d9c4f8
- SHA1 e06db5613d0cca29f3fba7c40a9a2443bb776518
- SHA512 457bcc3aaaf762e95768b956e24df4cabfe8f572630ffc3b7fcd1dbe445d10df42dbd14ed7f0d8ba248f087dd526d3cea8499a05d67f7dd83828e96cb2933c81
- SSDEEP 49152:3PkQszEIEgPHm1Y0sr+NG6mvEA2famO2aJwBeDZ+6sOFWeX4WNwo44JD9SrcYTEU:p
- TLSH
  T1D116504B6AE62421A257B0B94E6FA4067635400F5D4AFD083E9C82E84F5D43C57FAFEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.de.js
- Size 46KB
- SHA256 4840ce5d29dbedcc21e3aef15fd1c4ebb82371e7f967d298fcf9668b6ab7162b
- MD5 ad9bf818536f91931fb650b3216dd18c
- SHA1 403d2a77da3ef57d26ae8517ab1911a2e06bc18a
- SHA512 a7489f6e059edd044902db53a486c3881ec363d9db065651692b60043b2a3b388dcd2f8041d460a5fb0a11201e94277815cea27145a3df00792953b602c95bac
- SSDEEP 768:HuYC1xYdRB1a3XqGzdigBdQqAaI/23LNdPxFpST1kF4AJhYmz7behjYWMuRBk3hv:HqxgVuXqGzdi6QqAaI/27NdPxFpWxAJ7
- TLSH
  T1A72307B19D46702A5FC963E1BB415D3B3A1CE2AE7A56500E487DC427204BAF9C6DF433
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.es.js
- Size 46KB
- SHA256 39c20b04dffe19f781303934bb52275bca7163b44f395e6caf37db4ca29e2ae3
- MD5 b5d76ad10828693d4789877118b40bce
- SHA1 0368e36c2dee4e6135e5d619870ef49feb932769
- SHA512 81e8e6f77ea88765333a127858c709df146d1d4ce7bc0106a5106b6ad1035250bf09a6de87894004e2c6f25d87a5705aa8c6b645b17c420dda3db82077c71ec1
- SSDEEP 768:N8nKFyVgAYwTQG8zHqIkGMvnmvoKA9OfxjB3EVuU13pjbazPnBANt7+OlzDKPp4I:SKFyVRcdzHqIkGMvnmvoKA9OfxjB3EVs
- TLSH
  T18623A73647CC175315D303CEF2D3D513D188AC89B068C1DBA1BA9AA560CCEECD56FA6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.fr.js
- Size 49KB
- SHA256 2476075bf25a091da61bbeee0c870169f796e68f30dd70ee6c8d28995f3920d6
- MD5 609979a6bd0e729fe66215c1fa383a89
- SHA1 6daf268486dec76a48de52731addcc2f450d6618
- SHA512 5afb9b43b684d2c517792947702dbe9a7ac7446abd4628b00bfb14ce90854995e06e7c5135056b52aa2450cec5644e66861a8ce98a51ba49277c37109e55f9ac
- SSDEEP 768:ILjlgb2uZ5CcXQ6Q3edz3uzATaY3l0y+dg90TWIvkUqBkiuP/oOjF4Zoczc3A4qJ:2liv5Ccg67SATaYVKEkimTjFAoAaZw
- TLSH
  T12933A61FA6C421920EC61BC3F5625593E874C88CB35DE316ADAF53D912C68DCE2DB6E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.it.js
- Size 48KB
- SHA256 01d14ba84f1e2efe3d153fe5ca48e04391620fc39a01b35f90e2db89ea3d9e7d
- MD5 3e3d0b63e450ec97e699801d491d91e5
- SHA1 8d28e0cfbac8ce6f70664a054d61c7ad69e1882e
- SHA512 a7eeed13a281d532567cc53cae6ee9fed68e57b7ff68868b7814dce90a537d9a3b9972757d9333866c7557023c37b13f3c7a3f8ed0e50d519445080726d785e6
- SSDEEP 768:gqEy7izsuMa01VaiYR2L8XoXNj8YtvnYbP4ymMb3d/gyKJdnPTrysribj5K3m0MR:j7fQL/j4Qq2FA1J1qn4mB7agn
- TLSH
  T1A123A83D0281211029DF13DEE176604EFB67A8CCBD5C316959BC052D35CEF98B19E7AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.ja.js
- Size 52KB
- SHA256 61c4daa3f0e1358fc78e69a057b5e1da3b639c94a70ea5ad6de5623d496d5517
- MD5 1b4528114945e6cada91efe8ce5c19f6
- SHA1 0d49f278175e0711af2f1d539934b98e9de995b4
- SHA512 aadf263e9dd6d4722a76154d0a521774e7d51500b5233c661ed55bce95014a94b724e6a196cd5ac47032ce508c00b2b183ae3b570576b633e45568df8d4928db
- SSDEEP 384:hg2PXPtm+04LZ+FFHr0ZA9qOSTvvIEveG1vz14NdahWMpA1Uj4vHba3RPDScLBkm:bPfLsIOCam3rJrYEIk/872rpvsk
- TLSH
  T11F33603CA7C0A8394D2593632A9DB4EA3455AD5BEC227736C13DE021B9B03CDD185BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.js
- Size 38KB
- SHA256 d91fb15a406fa334895f5fa5bdf1da02afca9cdc50220b4b597f18ca6869e75a
- MD5 25a6f54d69d6ff2426396a68e19b53fa
- SHA1 6edc8f277381e88de77d0f4462366c6fc7974b98
- SHA512 2340b961e83abfc4dd067cf4e51ad71b48b16e4ea6c7d224754912cd5e3711c4eb63d70adb8a7f42fb5d42dc9dc68bc32ace46ef005373f579ac0d937f9e3947
- SSDEEP 384:hO8LKmvQkKEQq4xlX7lrp1E1bIJUeYB4jV87XfVGZ3H6Sq6B4wCJjocN986t7J9L:U8LlfQq4xPp7pFBsZjYKqk1Vetbe/
- TLSH
  T11E03FAA3A3481337298B06EBB6EEC194672A5D3C7711535AA4EDD43821874F093BF9F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.ko.js
- Size 46KB
- SHA256 ae5895709821f36a7edc58a61967e925a3d3d7b0a3ae29042a948743cff8d0a9
- MD5 43f772044f04b44c2db113388a6a5fb8
- SHA1 cc6714152dc7b7ae61b0a74444f84d0462f9a9ac
- SHA512 c36cf14b60fcf431949de5afbee0fc836afea5c01632560df704848332d43277cfced62ea38c89488350b66db539d64b3e5982fac55c6a0d2a11e28bf6f1fe6f
- SSDEEP 768:cOnmkUxK1pLkKgljQM1r0xXDj8kCpY2XlGyrHuivU1Azrtu1QrWp4cX6v:RZUxKgKzxzrCp9GyrHuiFrCQKp4cX6v
- TLSH
  T1A72301E239DB93983547CA815AE1B6758382E5B7FB8301C0CD96CCB0CD589E7444B9BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.ru.js
- Size 75KB
- SHA256 25fe81d3e67512248d7c361a44f65b6902818a27a6674484fd168524f6e10e2b
- MD5 8e4f383a3091adcf8902b126d58d2bd5
- SHA1 fe277bc0dc079282b51f38486d3d609edf3de599
- SHA512 1730546448dec4f573f53caa088f0efbd583395b181f35e8a0b28f04a8600d727b13908d7c2f413e2b80ee5fd57a53bfefc729a89d23f614aa20287aa4d90061
- SSDEEP 1536:U/0F6MhjpIMbBBKOXnFCSHhEUVCcan9oARyGuYQI/c:tPhjpIcB8OX/HhE1canGARyGyI/c
- TLSH
  T1CB7337A156DA50AE0200B50BDD087E493EEB46FE3FAB533615B43D7E34F3024C66E669
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.zh-cn.js
- Size 36KB
- SHA256 f4d6e40540aecd433aeae871fb64ea1d711949b10843c61adacb13a2c7565b06
- MD5 368b9af46e5b7dc798f0d9bf8286374d
- SHA1 3442974703766081a3afdbe0dfa0bcfe112690f9
- SHA512 56a29d8b195f2b23fcfbe930a1845a645f53e3c7982fb2000d5590cd2d501a538c238bc2376adb621c2eb7938440439388a1e6128a7579715cc47101f140e3c9
- SSDEEP 768:kbVMLHwwytIZgIlChuIW9P4CAz9NlLNYAdszzHfVBI/C4Y00llmR+V63:YPPdzhuIWQszzHf3IXY00llmMV63
- TLSH
  T173F2C6941BDC6FF93C021381671E85267908670B753BE021A7F3FD9D20919EE46E7A72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.zh-tw.js
- Size 36KB
- SHA256 04a70ba24136660ea074095aa01d4d01a399cb9104cbfe8bded202538ff76d68
- MD5 1f4ff6a381a8c58e1c91e28da60f42b6
- SHA1 f9a54cf63658a87f6ab1130eeba0bf183be57fc5
- SHA512 66a31b61d711030171c12dede7de56942e19ca3add1a3c646f1dcddfd34b9084c3f114d1e1cdfe3d457c2cfc12e68dc5a1b21ba84ef43923c0bca21ca542d817
- SSDEEP 768:bHetcy+xQHM2k00fZvOjRUcdFF/JwN+QVEWrn05ZxXUeqJ1wrv6Vl900pgL+K14t:isxQHM24ZvgdFF/yN+QpiUeqJ1wrv6VP
- TLSH
  T199F218650FBD5BF83A05F3AD270921161C0E6B0BBC3661159B7E7EA424977CC23DA8B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  Velocity/Bin/Monaco Editor/vs/loader.js
- Size 29KB
- SHA256 f4f992573d388f87598c275da26f8597a68801378ee8438166c703bae1bfa1d0
- MD5 28d495de7e571f6cc67ffa30927dc189
- SHA1 8dffcad06874610e2ae2cb89be4e8bea9414aa46
- SHA512 12336df4ada164eeda296d8f47927c9b8a98af8d8fa940511481aef2865f871808ad15aea953009cfa65f4f2d1ddc6f94597d1a32e8b3c75bd65925c2cd1d269
- SSDEEP 768:DJ6C/Hdqo+gvwTeMq/soU2j8hHN0mJJjvrCfn5SU4RVV+g:N6gH3PwTRLpJ91t
- TLSH
  T1D9D284CDBB9474234347F4E8D07F111BE2BA965A144D842CB11DD8DE2CBD58AA23EB78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  Velocity/Bin/Monaco Editor/vs/loader.js.map
- Size 119KB
- SHA256 aa6fa8ff3f7954289f79161468a013f9619ee7f20834601b398b457be4c71e7e
- MD5 3a2301f5f45fd27052e38b602aa9e659
- SHA1 e8118eeedc331a1e5063402d94619563213d6663
- SHA512 963652e3ab1ff1ed73c9424a74b5391449d69d3bae3977b0527fb1450c491599bcf2b0ab4eb183c7556d82f1bd25c30ffb25a70264b2e03db15ddf45019c3a4d
- SSDEEP 1536:cPDTaNe1H3mveWCCuu9A9RDEyzO28U7mdDEaBQWeWUWeWNPV8AzNzWzTnt0iw7pe:T/mq+o7Rl88xM
- TLSH
  T175C343870E53E436531FFEFEDAE94152EEA8B2D5126981007C0C42CD2395F59B6DCAB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  Velocity/Bin/Monaco Editor/vs/pickr.min.js
- Size 23KB
- SHA256 a3db381ded98175ae567fa6b3e2ea3a4c4ad17748ac6ccd3f303b203aafd3345
- MD5 7994604c603d5bc54fb725733baf414a
- SHA1 ded56a6cee7bb00e7f29bfe7162794600fe715ce
- SHA512 03d8020cba44269b98872dd87fd7a0c3a42ae7406ddcdcc7bbbc96acce812a5fdc17cc9fd7dab0db66fc1a5c5d3aca827a64bd057b02713e767f25449ecb1a90
- SSDEEP 384:y3nktJFOieg7EQF1x2p21rvjjjxmXAygJMlZZ4KWQWzb/Gaj1KYC8dulwMJ+uy4q:knktJFObgYu1xcojjxmXAygGnYC8dulw
- TLSH
  T16DB219947682B93122CB45DE2035C80AF2356690F04B2594F16DCDEE1BEEC84B6B7B7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  Velocity/Bin/Monaco Editor/vs/script.js
- Size 2KB
- SHA256 c3a86d3888ae90702410353fa7bf5de23042874ad227322d912bb3c281bf6605
- MD5 c1ecb9095d856192846af27ea08d366b
- SHA1 cc6064f8d6d2d0dc334b76f86a471ec752c6469f
- SHA512 5d8b7b56290f28879d99ee8944ca1f3bc3a43db16a777248b6e0f8baeda36f1cf6508491af1bbe1ab1aa54cb31bdf1f43024f6942491ff6751c04ab076ac961d
- TLSH
  T1A941E2689DB20184792B141E77FFD61038F065739C14DE24BABCF9509FE981B429E6E8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19
- Target
  Velocity/Bin/VMProtectSDK64.dll
- Size 124KB
- SHA256 d43329ee5af52665bc4afc3f7dcbe1d8aa13528f49d7580df15a9c9ced50c0ca
- MD5 3339229041a6aaedfc037afefe58813f
- SHA1 1121e690c877b23a623f57b8d339b494c20b209f
- SHA512 bff891e88d6b956bd75fee560fb6c38577322c4a61a288f6ab7baa8e0906d2fdc5b00a936359fc98f0b060940c3418d74412d97d7ab8abdd11603b6328051821
- SSDEEP 3072:1mcqYHq7Aiytzg2ScpvgJcG5sqYX6UOHNlBS:g0Hq7AiyegZgJZSXmtH
- TLSH
  T1A1C37C5773E540BBD1B6CA79C8638A56D7B178110B24DBAF03A402162F233D18F3AF62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Velocity/Bin/erto3e4rortoergn.exe
- Size 34.3MB
- SHA256 e201d3dcb1a017b75d2df9eaa736a779ce8b2c3525269c69f7a3c00767e79627
- MD5 c67e185684d99a7d964866f3e90f71ed
- SHA1 0e29ea71f19d147423d6564197410c0d5bf7db75
- SHA512 800dda74f5a654299536f15584ebb82f8f25367c402aa2161313417235b64e0df3d2f59813544b6229358d530e7d13a65ccc624cac78469a449a191315e30778
- SSDEEP 786432:QZZs+qlzFOwJx7CxN/QC9N6bVcFb5dNYK095IkOB3m98YyM1:QoHNFOqlC9Nb5dVkOB3m97yM
- TLSH
  T16177239264D463F4C5C3450C528F129F61D1687B86BA5E0C6AC29C031A71FFB6A8EFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral21
- Target
  Velocity/Scripts/Favourites/Dark Dex,lua
- Size 769KB
- SHA256 514dfbb86b40ede6f3d0abd70b5d2935c807161d815138f23ecb0ffffe1eace1
- MD5 fd55d68a2c6b02eca802fd365359c1fc
- SHA1 6cfc853cecb82cc6458e7d9bf1e87336fdd637d6
- SHA512 41feb566b622b8eab94fa8ea53124359a12904f17cf70e240fd8f2dbca22ee9c3f219de22af573c36f1ca7962626819abbaacbb5a484c90ad50bc6d5ea744ee3
- SSDEEP 6144:8DS0p3l3XgRGS+J5sme4dGuRXPnJZXBoiZ0DbQwZNXsDSyGQE4SRJ48RgQxAaNS6:5VYTeCO
- TLSH
  T119F4830C22898EFE97636D64B0E3158DB2E86263D3D91540E1BD4E1CF24DE5B05B7A8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  Velocity/Scripts/Fun Scripts/Infinite Yield FE.lua
- Size 472KB
- SHA256 1c071c31271791272a4d21bc2ca6b571b20020444a33883611c2b315247f8cb5
- MD5 aa40a2d10223dcc7eea00701a53cfae9
- SHA1 a5772eda1152fd8917c4de08814b7ac69b650c63
- SHA512 65f11aff17166f846ae0ec6e451cf4df0dbc3dbeb4da4a90e472e86db5c0769b0db9b05e1c75eb095c88201811a12e115b7ea5cae86187b69e3ce123c8435b72
- SSDEEP 6144:FGfBMi+jpIPxvuv6oZf8D3xzLdzFI8gOyT8NPle+niXX6rWagl8Wi7ZSnjPuO5HD:AojpIPxvqfyh1F9NniXDX+O
- TLSH
  T17CA4F79E319E16AD1A17A26DB46308463EBFE03510091A5DF8FC513C6BCD60F81F7AB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Velocity/Scripts/Fun Scripts/Sirius.lua
- Size 182KB
- SHA256 52a0ca20e499400cd766bc9676ded35d0eb0a9bed6bb20bea5488f3054575fed
- MD5 b5704851fc56ef02c7450068c1c9bbc9
- SHA1 ba88206f41d9607057ef9bd3120e29972b5975bb
- SHA512 d3bc75dace3e36d61d1bd78a92bb31a6028e509326ca0c6d09dd0e1e2749e3cd5bf9e37e7cb49d68a21fa22200b3bb3d20f70c7cb57fd1e2015fc1ce5d948b4e
- SSDEEP 1536:SKsQCXCWXIaIi/f9YeUAaFEuDQTvbRVinAx+j:X9CXCwId7eUAaFEuDQTTKj
- TLSH
  T1A804C58C316E62FC44A3418EE56B0415BEACB220626D5045F9AFB4BDC8CCB4EC5D67F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  Velocity/Velocity.exe
- Size 43.7MB
- SHA256 2d36ec0098a47b73204c496951aaeadaf5a1a4ec68799c6ba1ee0a6bd9b53a2b
- MD5 66fa6eeb97942d97ba749d96679b102e
- SHA1 08b9c7485c26811ff526e3aa86408905ec556407
- SHA512 8acce7ef408362f706d3196284d93b9ba00d144e35a8c090228a3f1684d85a0ef8a0989efaa7b24d34c76093e5a4955fedcc7175ce8bad9ad7faa5b18c479f08
- SSDEEP 786432:76ujzestksktGmU1K4m6djTILYLRnYcnWqlPyNQW1Z8d3OGxt6CyUg8AX0U1:tzo7tU19NIsFWqlPyNl4PxtrUt1
- TLSH
  T11EA73319F6EA82BDE09A4330CED1421AEB747C055F98979FA3647D391FBB240C938719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery salatstealer spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Downloads MZ/PE file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral25
- Target
  Velocity/VelocityAPI.dll
- Size 17KB
- SHA256 7f8b8d05d22c24e9444e8c5da63e5631c762971f4ba6e79ba823fe3880fa95df
- MD5 229bdd461d751c7b63e61c926f5ed6b7
- SHA1 d2569c72e9408de66c36780e5c48074dd605db3a
- SHA512 c416b319574fedc597bb34710b22348751c976606602453890718eef9effa99c8bfd845392c8ffa9dd6c954e778e5e6d5fb57752cf4dbd40821eec9dc49b015a
- SSDEEP 384:BVrr3r+K+ftBdZ0rCbv/YOJaPhLuo2O6xNEQEQrzdaRS:BVrr3r+K+fPh/Y2UyDVl
- TLSH
  T193721A0A7FE8C677E6EE0AB85871021043F3D7157823FF5D68C7A4992D63B4A4614B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  Velocity/WebView2Loader.dll
- Size 118KB
- SHA256 44ab92c2246ebfb5f98aa5726626fb44beb61543f2ef1803338af9fd295e63f0
- MD5 7b0eeac10cafb4acda98ccaf2f4b8eb1
- SHA1 9af3bdf0f62f6e4b3a936afc9b77fa9ac5a088d9
- SHA512 466b751a90d3b63e6394b47d459da70ee20eb7d6d40c48153996297e460fbaa02f32cab10b737fefd03a2ea62bd273025fc2ccde850faf42c904044c7ea8dab7
- SSDEEP 3072:F6JOAfv0Zj/zjziMy/4rnF4+jqb22EA2TNTEtJAfiPjezIgUW1:F6JNf89Q/In+qPEtJ/QNh
- TLSH
  T1FAC37B5075D080B1E5BE18390878EAB69B7F7990DF609DDB27841AA94F343D09F31B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  Velocity/runtimes/win-x86/native/WebView2Loader.dll
- Size 118KB
- SHA256 44ab92c2246ebfb5f98aa5726626fb44beb61543f2ef1803338af9fd295e63f0
- MD5 7b0eeac10cafb4acda98ccaf2f4b8eb1
- SHA1 9af3bdf0f62f6e4b3a936afc9b77fa9ac5a088d9
- SHA512 466b751a90d3b63e6394b47d459da70ee20eb7d6d40c48153996297e460fbaa02f32cab10b737fefd03a2ea62bd273025fc2ccde850faf42c904044c7ea8dab7
- SSDEEP 3072:F6JOAfv0Zj/zjziMy/4rnF4+jqb22EA2TNTEtJAfiPjezIgUW1:F6JNf89Q/In+qPEtJ/QNh
- TLSH
  T1FAC37B5075D080B1E5BE18390878EAB69B7F7990DF609DDB27841AA94F343D09F31B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Suspicious use of NtSetInformationThreadHideFromDebugger

Detect SalatStealer payload

Family: salatstealer

Downloads MZ/PE file

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28