Overview

overview

10

Static

static

3

Bootstrapper.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Xenosploiters-Roblox-Tool-Main-Edition-Pub.zip
  • Size 389KB
  • Sample260728-vapp7azgmf
  • SHA256 2cd1571018157088bbad2b9026a1d065332973db770f9ac506968d6885a078a5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
salatstealerdiscoveryexecutionpersistencestealerupx

Malware Config

Targets

    • Target
      Bootstrapper.exe.exe
    • Size 389KB
    • SHA256 d9caf6b0f7220657c8ebd40ee6e8a20ce2ff71b977d99553c3db0b59bb0eaad9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryexecutionsalatstealerpersistencestealerupx

    • Detect SalatStealer payload

    • Family: salatstealer

      SalatStealer is a stealer that takes sceenshot written in Golang.

      stealersalatstealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks