salatstealer | a8c619f5c24fcd239d62f1172becbf20b69ef56ba1ecda0f0e0c7ce750a1bba2

General

Target
2026-07-21_a6e86ccc1233af8799789674ac63563b_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc_vidar
Size 16.4MB
Sample260721-bmvmesbs5q
SHA256 a8c619f5c24fcd239d62f1172becbf20b69ef56ba1ecda0f0e0c7ce750a1bba2
MD5 a6e86ccc1233af8799789674ac63563b
SHA1 b43a2ec013310d5266d232b1749158013fa1c7a1
SHA512 ab14cd80078c3c5251577f0ca276cf739595919fb64e6a03bcb9a9cd738f654865b909eb07db19396b402cc7032e119c4faedf7839c99d61a6a100ffd3084e8f
SSDEEP 196608:d2MUTSVbj43K6fFuP5j50TcEb7s6xzg2JuptN0+xdPzpZVr2V:dDUTsbj43KiFk3ub7s2g2JuB0+xd172V
TLSH
T15907BF1AA3BA00EDD476E0BCC9939A43F3F238465731D7E70592896A8F1B6D14DBB350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-21_a6e86ccc1233af8799789674ac63563b_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc_vidar
- Size 16.4MB
- SHA256 a8c619f5c24fcd239d62f1172becbf20b69ef56ba1ecda0f0e0c7ce750a1bba2
- MD5 a6e86ccc1233af8799789674ac63563b
- SHA1 b43a2ec013310d5266d232b1749158013fa1c7a1
- SHA512 ab14cd80078c3c5251577f0ca276cf739595919fb64e6a03bcb9a9cd738f654865b909eb07db19396b402cc7032e119c4faedf7839c99d61a6a100ffd3084e8f
- SSDEEP 196608:d2MUTSVbj43K6fFuP5j50TcEb7s6xzg2JuptN0+xdPzpZVr2V:dDUTsbj43KiFk3ub7s2g2JuB0+xd172V
- TLSH
  T15907BF1AA3BA00EDD476E0BCC9939A43F3F238465731D7E70592896A8F1B6D14DBB350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery salatstealer persistence spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Custom signature
  
  Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Custom signature
  
  Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Custom signature
  
  UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2