salatstealer | 29d5fa9f775df70c7e54b2c59bf9478778a8f65a742aaa2feea3c06b2f330a91

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_77288a11ee08a36faf36b0b55bc56b8d_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch.exe
Size 12.3MB
Sample260722-v7b6cswyet
SHA256 29d5fa9f775df70c7e54b2c59bf9478778a8f65a742aaa2feea3c06b2f330a91
MD5 77288a11ee08a36faf36b0b55bc56b8d
SHA1 2d251cd61ed250c93cb4b63e04dcbdf60a29b72a
SHA512 0942b325f14c69f96750e76a996bdaf1a736f5b660f8f52634b4628942f77670a2649c7ea10f03dc064d2343dd34ffa198c449d6c3e9fa0ccd965ccc5d685e0c
SSDEEP 49152:YlSgjEiTDpLhD2hkB0/0bt1RaZhUPUtOJIddQ9o+93it4D85gtQGXFUfkirjzuna:RgYiChkCsbJmv5+LFUs4ZuOEgdwE
TLSH
T1C6D64B02FE8794F6E9039831506BB23F23305D048B25DBDBEB447E2AF877691196B749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery salatstealer stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/5824-0-0x0000000000850000-0x00000000014A8000-memory.dmp	family_salatstealer

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/memory/5824-0-0x0000000000850000-0x00000000014A8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/5824-0-0x0000000000850000-0x00000000014A8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/memory/5824-0-0x0000000000850000-0x00000000014A8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/5824-0-0x0000000000850000-0x00000000014A8000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5824-0-0x0000000000850000-0x00000000014A8000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3300	5824	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_77288a11ee08a36faf36b0b55bc56b8d_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-22_77288a11ee08a36faf36b0b55bc56b8d_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_77288a11ee08a36faf36b0b55bc56b8d_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 260
  2⤵
  - Program crash
  PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5824 -ip 5824
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5824-0-0x0000000000850000-0x00000000014A8000-memory.dmp

Download