salatstealer | b1c49f17ffa5a64b8fa559e8e589f1dae1221c0b5510f40ed97a964f3eb04502

Sharing

General

Target
Zapret.rar
Size 16.2MB
Sample260716-sb2p2afy6p
SHA256 b1c49f17ffa5a64b8fa559e8e589f1dae1221c0b5510f40ed97a964f3eb04502
MD5 f28e26126cdd645c7e9f992765407459
SHA1 38e74e11c82e9e6458b802a771efcd1f2420637c
SHA512 d934722255faf190fd07ebee79084363f8eb5f544ca041a3ed40f7be418cb547c13708eebbc825216c392632a56e148fd130e667ebea75de433577ffae6f191b
SSDEEP 393216:Ps1vtByOrT+SH4eIrUu0YUNlJIDbxRZ49dqQcH4THHJkrajiwsenafO1w:Pc0OuIuUJIDbWKQc8nJkrZilw
TLSH
T1470733DABEA8E2CCD19C2347B1CB4E214355715F3DDD2EE26E93788C511486EE40AF1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Zapret/bin/bin/Error.exe
- Size 4KB
- SHA256 c3ba2c5098573633e543b3bc964377c5a543d4a52722501140ff8f36cd38160f
- MD5 d4a38648098d25fc5435d05c633d456e
- SHA1 eb504a492f40eb107e969037d216dcd6e0dd9116
- SHA512 3b8d9e37924299b0e2189f5d8461344a36cf33fae73b0cabeb31f92c46ce7d2de30fdb5235234a7edceb5b325ef69d3d39aff3da1f50ebab71349b371ee1f06a
- SSDEEP 48:6aNhiUnTek7pwf9WYJvjvcH6HGjeDzuRg+MqHcGPuGOulhIrqspfbNtm:NiCtwsYjvUyq3Rg+FcUugTIJzNt
- TLSH
  T12E91961743AD422AF82543309FF34B8126B9F6144B3717AF65CE5D6B6C1E7301A23662
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Zapret/bin/bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Zapret/bin/bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Zapret/bin/bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Zapret/bin/bin/winws.exe
- Size 199KB
- SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
- MD5 d498e19bc7a79dd1efcb6b928cbe9909
- SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
- SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
- SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
- TLSH
  T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Zapret/bin/bin/winx.exe
- Size 12.7MB
- SHA256 72cc4362b7b6555efc9f0ae1a51724bbab72a19a1d707b43833b3ef68db9d001
- MD5 4f439541434d87d568401f6d7aa5b704
- SHA1 56bb6f4a8f90c57fd684bd802ae09e93beb8ba12
- SHA512 185ff06815afad9fcfc73bf3eebe442f3844b9334e041717ff6726865344b5fb7fdeea8c8e9abe1545481534362e0d97999356b060094e97467b0ca8b51e97fa
- SSDEEP 393216:FuZD/CqJSfO3GH6Yk4dQusl/Iwd/CAHns9r:QFEUGHf7dQuyx/ls9r
- TLSH
  T15CD6331567A404E7DD79C23C48B2429CEB21BCA80BA1E6DF13F4A3A63E173E15D36785
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery salatstealer spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral6
- Target
  Zapret/bin/general (ALT).bat
- Size 3KB
- SHA256 1c0b20341128ca2dff78902acf5270a071d7ea65c7694549d4269c7730b61d1e
- MD5 d355b57b5f43df082d8337a807d4f2d1
- SHA1 e3c40c9ccce9d028ee2aebf0748a6321b70a00f2
- SHA512 2c833ecf2da0eb4ef83f7d37b43c4625821977c1afcb70df301fd61a21e498c3a39194181231e83852857eeb6b2e429edeb33bf396a96937df3e6abdca83fba0
- TLSH
  T131712CA7E00CDE47F5CDA93EF85FA5A42027D88329D6D452835B89F8CC4EDBD584E484
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral7
- Target
  Zapret/bin/general (ALT10).bat
- Size 3KB
- SHA256 9ce4a37ad5535b7b6316a0b8fb578d42af87dfbe5077cdd077ed67901e603dbc
- MD5 409198f7c2281b7abfa91fec2a8f7f65
- SHA1 3317dd7465c55bacf67ffd02540052b3d08b75d5
- SHA512 44de55a3221e943a6927963def4964c87c8cbb90a332247c35f493d4a324afebe8279130ab3f1214a9224fc80e8b089874ca59fd93e4368bcecd2fdd00e05f30
- TLSH
  T106612B93E00CDE47F5CDA97EF85FA5B42027D88328D6D452439B89E8CC0EDBE584E484
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral8
- Target
  Zapret/bin/general (ALT11).bat
- Size 3KB
- SHA256 c9ba68454e647c69d62a96eca3b378e3bb60cd22cd66d759c945ee24fb073e2f
- MD5 28dd9521447db4339428553457cd1210
- SHA1 0d449fbfb8a808d2b03d689649e8c419e268c83d
- SHA512 ba3ecbaaa0024f307424327940d7942bfb9594033375f33270a48c6c44918a4138e0ca083309f71298ca25787d5454203e6286411475831a6ab3895e55e47f2b
- TLSH
  T1118148A3E00DEE46F6CE753EF85EF6A52017C8C328D6D452438B89E8CC0EDB9594A084
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral9
- Target
  Zapret/bin/general (ALT2).bat
- Size 3KB
- SHA256 3dfab68519b23c747a6de957c197c467b2dbe5c932ac24713b5d5e31f18f4af2
- MD5 d43f122288ff522b2d1a3886c09495d3
- SHA1 cbeecf7b03fa0d00b3fcfaa666bc42074c501ccb
- SHA512 a51d2386d837fafb6e7387ba68e324845ef067e1050863b8235f86e0d6a7bd162a09ac47c08e32145097649628e5e66eba097dae3a2e12727ea1d53f1f733bb4
- TLSH
  T107610467E00DDE4AB68EB83FF89EA5E42007C4C31CD6D462539789E8C84EDBE494E485
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral10
- Target
  Zapret/bin/general (ALT3).bat
- Size 3KB
- SHA256 5e50cbd4e74796a8fb42555b076cb1b7d5abcf5ffe1227c8d82f17826732b37a
- MD5 1dc3caa65a31e27a19665c0628e90fbf
- SHA1 e87b05cf38e76d6c3d9f7b47283714d7ec4bd252
- SHA512 a8a8cc465dfd819359c2aa18896a11511fde6baa56498a53e65fb8afeceedb8e8136574508378abf964e2ece8024bd436af98800e92ce720366531cce299e8a4
- TLSH
  T135715C93E00DDE47F5CDAC7EF88EA5A5601788872CD6C85153DA89E8C84EDBE6C4B085
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral11
- Target
  Zapret/bin/general (ALT4).bat
- Size 3KB
- SHA256 2ce749c1db9918215833af6cc116be096ea0e1c07181f81b064ef0f61c396cf4
- MD5 5dea9765ef6d50a7dbc77e700876b772
- SHA1 d402563301556be0be5d189e7015f74614e598fc
- SHA512 8b75a6ff7af0069116aa8d6f7502efa3b93fd1b4a9b98855ac4aeb9fb37f38dd8f59f7091c1d87faeda89a344a606b33fe2f0c0bcf5fecae8434f46543854a40
- TLSH
  T103714A93E00CDE42F6CDA53EF8AFA5A4211798C31CD6D452439B89F8DC0EDBE584E594
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral12
- Target
  Zapret/bin/general (ALT5).bat
- Size 2KB
- SHA256 bcf8bdb486cb76150436010495e3a034b4568326add99ed44522050adb58e97a
- MD5 ee50f4d311623acf442d9e1f8af573d3
- SHA1 ec3f15f044c9efd71a69aba8aa81ed587e0db823
- SHA512 2781b69c60de50a1e6ccbe6d69062512271e857e14d68f78b1253fae2ae716994c89118f1d257f2b901efbeb8d572b51668107176e488c14ebe73fd316d783ae
- TLSH
  T13D411487E00EDE46B48DAC3EFC9AA5F5601BD8C71CE1D462539788E4D84FDAE8C4E484
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral13
- Target
  Zapret/bin/general (ALT6).bat
- Size 3KB
- SHA256 683d210becf3926d0ebd0bf76de6ddd6204bdb27bff0d90c5df30aaeea6843e5
- MD5 de4e78504bbd89601460918ba09e77ff
- SHA1 3cfb349282f4409d9db8f355d0471b7e6ef40300
- SHA512 9de8358a74ab668266e52b01808fcd2f13dda094d6330b10049cfbc4554921ad9325647ed574153cf07e71f0f2d8cb48045efa089db448dc37409f2191367fb4
- TLSH
  T16B611557E00DDE4AB6CEB83FF89EA5E52007C8C31C96D462539789E8C84FDAE494E485
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral14
- Target
  Zapret/bin/general (ALT7).bat
- Size 2KB
- SHA256 ff49bd6c4281da322925375465d57143e00ea9ea6d17b79e388801150c973802
- MD5 f5a674210e392baeb032d9bd1b4088b5
- SHA1 0e91fa044cc5ea7c7e4fb73c028ffc3a0a289830
- SHA512 d3a4a40572ca44c4c620515be20350e420f720ee357c447ba9b55baaae397630fca0a08cfa4282668145673c1ae4f726cb82ae285f54317c1d368aa2cfee788f
- TLSH
  T1DC51E497E00DDE46B68EA83FFC9AA5F52017C4C31CD6D462539789E8C84EDAE4C4E485
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral15
- Target
  Zapret/bin/general (ALT8).bat
- Size 3KB
- SHA256 c561a5c35b7295488a5e2c3b45ada9868268177c3b0c397c9b5f02f7a4f955d6
- MD5 de3a4d9ec9fce357967e19b0c054eff3
- SHA1 b93f91b82847155cd2ef62360a4999df8c5bc7aa
- SHA512 849cf8815d88c3ba195902c258f2bc250d136c6e0e591c130555ef6bcdee12026e1b77284d5b7ea1549aaaef13aa7e69def1152bb9a98a81d430235e2a3fb6f8
- TLSH
  T128611893E00DDE46B58CA83EF8AFA5B42127DC871CE2D451539B88F8D84EDBE5C4E584
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral16
- Target
  Zapret/bin/general (ALT9).bat
- Size 3KB
- SHA256 ae85bfe4fdf55f39abd09bf15d8b1e8ad73f0887560d3215e672985b4a07a74a
- MD5 1779c9793bd65ae735b42e92da222cd1
- SHA1 2659ec140ce3da380675834021ce5bed5a2831de
- SHA512 c794c2e7e69b30344ec79b330dee8901f2ae7ade96465505ffc8e49318f1c5b82aa87684ac22ab5eac023231a27b39cd3e0700424e96d715dcadc9c827e86772
- TLSH
  T132516893E00DDF4AB58DAC3EF89BA5B52017C8872CE6D851638689F8D44EDAE5C4F085
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral17
- Target
  Zapret/bin/general (FAKE TLS AUTO ALT).bat
- Size 3KB
- SHA256 c10d3818ead3efb0f26dc80d35a2a2735d577737ce38cd45055791ee29836231
- MD5 72e1f282f88979e3510f7690d48e488f
- SHA1 2f58fa65a5abf93cf4ea47e23549f8a9f1353656
- SHA512 a5607d8e6a7ce0ef6ce174d69793f3e6e9fa5841c4f98022a8bd7dfeb4e90bbd7a4e2a8ac5069d252178596c8b78eee017f1be1d28e85074b64b61398700b9b2
- TLSH
  T1BE713D97E00DDE47B68D683EFC5FA2A42127C8871CD2C851939B84F8D84EDBE5C4E594
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral18
- Target
  Zapret/bin/general (FAKE TLS AUTO ALT2).bat
- Size 4KB
- SHA256 c5dc0eb693b704ace4995e19a148c2c9c41a75f1e2cefd074541d035a3b72e17
- MD5 21279decfa70b65fb3a533496bd313ef
- SHA1 9484b8154ad7ea80c774f18eaa952a2ed9c1b9c7
- SHA512 2fecad120c2234efd47628d4ae906ebed84cd9ecce510b246157f4a9e4e11aac7677a09eee3d9e74f57ea38e7b0af6572c7441f1284064eebe3cc09262bcdfdf
- SSDEEP 96:nL67mQGB/GRRQ1zXDUGB/GRdVv/GRRQuv/GRd5P+Rv5+RRLxn:AmQGB/GRRGXYGB/GR3v/GRRDv/GR3P+4
- TLSH
  T1CA814A93E00DDE4BF7CEB43EF86EB2A5211798C31CD2D852839B45E8D84EDB95C4A194
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral19
- Target
  Zapret/bin/general (FAKE TLS AUTO ALT3).bat
- Size 3KB
- SHA256 da4cb05eef4f66356384beada9302ba2acb269d74a789a0fac50a44a2b357655
- MD5 eef808aa25032177a59fa406a453743e
- SHA1 6b6d032a9d820a8d3d1aaf05accb799a1f61f1a7
- SHA512 732c2064c03897da5747db960483304c8f0917252d2e3e6fb9e8b0927b2b6a3422600849c14cb088660748181b73eab9b6d64f993a7c8e98da5523f7eed096d3
- TLSH
  T135814D97E00DDE4BB6CE743FF85EB6A56017C8C32CD6D452839B89E8D84EDB95C5A080
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral20
- Target
  Zapret/bin/general (FAKE TLS AUTO).bat
- Size 3KB
- SHA256 6326284fff6fffdb101f9027c9a1b8bd9a62b03da4605561f908c2e1e98a8a13
- MD5 49cf9f31a18d2f27b1bb19916a79967a
- SHA1 079281cd8e2499689f64d89e39d12a5a88f48dcb
- SHA512 9abce64a0798cce1e99cd1de3f8564dfdcbb5cf8512de67be1cba81bf741a2d6ad96edb97bc8c94752cf4db038e5cb7cf8d04238e4fa5bfb827df606a0cc1209
- TLSH
  T14D713C93E00DDD47F5CDB83EF86F76A86127988328D5D861839A88E8DC4DDBE584B484
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral21
- Target
  Zapret/bin/general (SIMPLE FAKE ALT).bat
- Size 3KB
- SHA256 e825a469e2ff34a74c5a2bda7346f35b75ac1f58993daa340d03c8a4dfb63405
- MD5 e2ac45a79d5d781bf0fbb9d266153f0f
- SHA1 e9dec0467e5bb7c781e0f311d0464374bcc96d56
- SHA512 a0d7689133ee784f02eda88bf21524f0e757165daed399a222de01ce736f707450eae1b687235974f754b02b0258b9d8e87445e2d25e771e7431d03524901fb5
- TLSH
  T162713A93E00CDE46F5CCA53EF8AFA5A42127D8C318D6D452439B89F8DC0EDBE584E594
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral22
- Target
  Zapret/bin/general (SIMPLE FAKE ALT2).bat
- Size 3KB
- SHA256 0d0dfa6269823a049fcbb76d0736fe2302fdb5a33fd3af83bbc96ee7c492061f
- MD5 c75118b35aab9fd82acfb952e6c28b5a
- SHA1 f8bf9e352f7039b87703c4ea84697d17220974cf
- SHA512 cbc28ac828efd918465dc68e8cc86bfd3fb11a743755639907e05a715b366e1ea2d361ffe4077a4e7f5932b6f361ec448b3ed18371f9c6a7389690175c606371
- TLSH
  T171611A93E00DEE46F5CCA97EF85FA5B42017D88328D6D452439B89E8DC0EDBE584E484
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral23
- Target
  Zapret/bin/general (SIMPLE FAKE).bat
- Size 3KB
- SHA256 5b8648d0b44253397e68b8c2d5870ffc2d908d2abca947da7b8d068a0eeddf8f
- MD5 7e4e87364ff4e030c37f0db72a1099df
- SHA1 bb9a9004e34234ab6b122b792fbf2fee44f54519
- SHA512 872b13254e63b518d6e02cc4f9828ec7425d798a2369f93830c701badc0a128716f259730af39b639ff27a7665ea0a20dcc4a081e9b9e83842e93ea9fd160d69
- TLSH
  T1C0610993E00DDE47F5CDA97EF89EA5B42127D88328D6D452439B89F8CC0EDBE584E484
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral24
- Target
  Zapret/bin/general.bat
- Size 3KB
- SHA256 47fac0d6b08bcac349e28141de2ca14df9f7cbbd83e16e4d126153c1df777dc7
- MD5 40f0c4b499dc8c797ec78cad6db065e6
- SHA1 516a3f5402e2eb5529b3ff088bb6fa4e71ee5b0b
- SHA512 9c48582e51497978ee87d0e2db496edafd34c847afc5e6e38b8986be9388ffbc0cdeeb65b4acbcb51efb34bc45a6d639ddd732478c5adb99030c3e1594ac0f64
- TLSH
  T1796136A7E00DDE4AB68E783FF84EA5E12007C8C31CD2D462529789E8C94FDBE4D4E485
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral25
- Target
  Zapret/bin/service.bat
- Size 28KB
- SHA256 23f2531de188a0755f9f43bfbfee01b6369ca68beeed16e2dc80f13f99f22f3b
- MD5 10cbb1ff56f67d7db15f2252dbcf96ff
- SHA1 0762b93365d1d3d75fcfbd06eb198235e72b6afc
- SHA512 6022ea148a8327681bb09314eee6344cd2e4b2385a6681f69591b25a5adf1ac37b29e244deac72e0287db4e827a6339640669dceb1ce38bd1e35e777744e3704
- SSDEEP 384:yvzkh51CE3utFcIuVMxe8AIKoPamn+CtIajzjjCXpEakDi5h6wUEz+omf0fOQwQv:yvzkh5RVGKWaYw1hi6MKkc
- TLSH
  T162D2502A1402586608B153B3992640E1F75A81D30A3176DE38AEC198BF7A76389FF5EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
behavioral26
- Target
  Zapret/bin/utils/test zapret.ps1
- Size 37KB
- SHA256 6053e9858bfbc222875738f1b7b09ad4978df6bc2cb271cad1729a26f909420a
- MD5 27823e3bfaf081f1ba665d0da16c090b
- SHA1 9a17287f3dbacc529737dd746b4112235628f6da
- SHA512 3e6b9dba62910d5aad61b86420498fcf2398add1bb4cf2e1df508d1e3cb14ae833cd4f217d38bd614b3bb25c3d1e7f7d907c9ec58f4b8f092e29cf666f6b28aa
- SSDEEP 768:jzk38oLsQ3VD5tftciOswyBw61H1Kd8YzP:MrrwyBw61ET
- TLSH
  T18F03A629B90A106F52735BBF9C816104FF57417B804916C0BD9CA0D87FF492EC679EAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral27
- Target
  Zapret/start.bat
- Size 796B
- SHA256 6fd32e145aeedae109e06919df7b9435eb1cec7af38a8646d1292947546de260
- MD5 e574f0c0c37d63e4b3ac76366ced812e
- SHA1 befc82eadf9061366e1f3075ba5ad8e8b5adf140
- SHA512 39af2efd76bf65cf8fae52a2a6c9123882446167c9ea55ec338c77b4086f5994df8c00de5784a686218fcf4efe2140e78e86f56a97ea222e0a59525c6151cd67
- TLSH
  T14801FD00731B063F8735E633DE56218BF49F81EF323D534A7594909D2AB981E8DEE686
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral28