salatstealer | a872ef3193be4f4dd3ab2d993623243f353ab3d5255cf85d6e32bc6732e14188

Sharing

Copy URL Twitter E-mail

General

Target
zapret-discord-youtube-1.9.9d.zip
Size 9.7MB
Sample260730-w44lwavemb
SHA256 a872ef3193be4f4dd3ab2d993623243f353ab3d5255cf85d6e32bc6732e14188
MD5 7522ca56ad13e9b574377cf3a6c3ed30
SHA1 9b2130d9f36c586bb3c9f564253f738eee81c3b0
SHA512 6fb7b5b95c872953cbb9b6f5b3d41793591917c5f3988330decd594e06be8537ab72f5645018add1e950231ce1de647918e7e21c4d10eb54d49a4f66623cea4b
SSDEEP 196608:YyzSi1IHQoZa+hw8hTb5VAdXAPI6t+eO8nyiTkZfyXIXGasY0cg0:BfPorhw8dAdAPIs+edyiTkZ9XGa10cg0
TLSH
T116A633C645FAA016C79D7A607B52DB41FF08BFC34ED6B0E64063CD9A24291EBA0315ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  zapret-discord-youtube-1.9.9d/bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  zapret-discord-youtube-1.9.9d/bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  zapret-discord-youtube-1.9.9d/bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  zapret-discord-youtube-1.9.9d/bin/winws.exe
- Size 199KB
- SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
- MD5 d498e19bc7a79dd1efcb6b928cbe9909
- SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
- SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
- SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
- TLSH
  T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  zapret-discord-youtube-1.9.9d/general (ALT).bat
- Size 3KB
- SHA256 c6dff44ea3c7159788077e31a8e35929eab1c0270fb86f5490d44b1fd049a6fc
- MD5 cadb63e600829d6d26aaac973d55d89d
- SHA1 c737ce586f9c4cc9d68abc62ed9a149f68d5b4c6
- SHA512 f9cfbb955e914dd9e1dfdf75d7cca4973bcf81e1dbeebb833e8e247cfea88b571878c8e80a638021234a1034e74ff9451c060c85b03a95d91d488011ef297738
- TLSH
  T194715DA7E00CDE47F5CDA53EF85FA6A420279C8329D6D452835B89F8CC4EDBD684E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
behavioral8 behavioral9
- Target
  zapret-discord-youtube-1.9.9d/general (ALT10).bat
- Size 3KB
- SHA256 7a8b4d861c4448ee3fb4aef61d79bcdbfc3ea0ab043145f643539fbd177c8864
- MD5 9a77b713dc626138ec7421f560716a28
- SHA1 06281de584a2f7a10b7d2fbd594f518efd7e4c9c
- SHA512 6e29b0880be24c85c9398fa21b88453b650a0f09045cc7701bba910aa74118e9f179da85b4db53e19b79ad9cfd524916583f7ac83e02c254a955f9ce8bec2c75
- TLSH
  T130712C93E00DDE47F48DA97EF85FA5B52027D88368D6D452439B89E8CC0ECBE684E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
behavioral10 behavioral11
- Target
  zapret-discord-youtube-1.9.9d/general (ALT11).bat
- Size 4KB
- SHA256 8df459fc47b6becbfd4cc54263ab99ee275a62c8a8097fb4abea236e29e7cc85
- MD5 81d21053303452399da6b09313cac0b3
- SHA1 f4ab94b0bcbb1e29e6f301f1e30772d64608c0a7
- SHA512 e44157ba880e11d3e0688856213e2ff3892ce47ce1013ff38c55a3dc0c376971804d777129fa823511672857905c0981ad856fbfb2cf7cc2b5161af95474826d
- SSDEEP 96:nL67mQGB/GRRQ1z/IKdUGB/GR6Vv/GRRQuv/GR65P+RJ5+RRLxD:AmQGB/GRRGgVGB/GRKv/GRRDv/GRuP+M
- TLSH
  T125914BA3E00DEE46F6CE757EF85FF6A52017C8C328D6D452435B89E8CC0EDB9595A084
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
behavioral12 behavioral13
- Target
  zapret-discord-youtube-1.9.9d/general (ALT12).bat
- Size 3KB
- SHA256 3f28b3788373c4963ba7b4e38112ae965fef2c99a812f023e9d2c736e99cb9c7
- MD5 707e7f6492429b89d52a665cb47d2e1f
- SHA1 5ce1c89efeda8a2bbf3419d1a7169cdfd08fae23
- SHA512 7c85dacf2a739dbe585b3dbea34354da8cfc49c10975f1215ed8bc03baa6fb6f3c57483f8926fd24a104133e90a275c8a5f51f808ee7d9007fa61b08edf847c2
- TLSH
  T1C0816CA3E00DEE46F6CE757EF85FE6A52017C8C328D6D452435B89E8CC0EDB9594E085
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral14 behavioral15
- Target
  zapret-discord-youtube-1.9.9d/general (ALT2).bat
- Size 3KB
- SHA256 94a8ef4dc67c5e04100c404604883cee6a7d8ad5d324395ecd71dc8ccb805d80
- MD5 802a10c9f71f69ebe61eeae7693ba0e5
- SHA1 8548aca5802a54f0bceaac04a6c22767de76f86c
- SHA512 a37d97055d38a04e4eef3853cdc7519f1b79cb01a63ccf66fe9558ae678da98e696443cba44847bc28ba08eb15f894b4f8b4fad470a93d0e345004a5ddcf48c5
- TLSH
  T1D5613957E00DDE4AB68EB83FF89EE5E52017C4C31CD6D452439B89E8C84EDBE494E485
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
behavioral16 behavioral17
- Target
  zapret-discord-youtube-1.9.9d/general (ALT3).bat
- Size 3KB
- SHA256 99c06ea66bdade72d43febbf4e5bd6208351ebd471fa99a39a92253e21526c05
- MD5 aa4abe5d986341f92ed5529c58002d5c
- SHA1 1d369c8ccbadfdf69d47f27aef30159b7f022243
- SHA512 6a67fd0193098890cdba4c0c6a51114eb7f10158d57f078c516a7a303bbff516ef73c7c478c9103d29c7d39b7168f7c26e4980c6389c4639d21583ec5fa86681
- TLSH
  T1AA719E93E00DDE07F4CD6C3EF84FA6B5201788872CD6C851539B49E8C84EDBA6D4B085
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
behavioral18 behavioral19
- Target
  zapret-discord-youtube-1.9.9d/general (ALT4).bat
- Size 3KB
- SHA256 feee3e7ecdbf3a5a46109b6018144954d793143ad4c889f3273f8ec1e8ac067d
- MD5 1a9353401fc545311572880d32a88f78
- SHA1 9e005a4a276e9b93f0499bdea7aeae070048d31e
- SHA512 86b79c6aa9cda652549cfce001c82eda023e32ddecfdd33d11decbb5afbe9b24fc5eafa5673fa1019a4caddd9ff32855cc6b78753769283f2ad96ebf0d8d44c5
- TLSH
  T1EE715A93E00CDE42F6CDA53EF86FA6A421279CC318D6D452439B89F8DC0ECBD584E594
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral20 behavioral21
- Target
  zapret-discord-youtube-1.9.9d/general (ALT5).bat
- Size 2KB
- SHA256 3e0a7026cccc02e6ca968dcd3efe4db94181cea190cecf4ac3e7e60d39d4dbb1
- MD5 2d3d8bfe1a53bd8e0d03b8339fc02546
- SHA1 9c02f16df41e3b7510209f21910331a7c3ca298f
- SHA512 7a00daae8665d3d61134e111bb61a88edc657a09744f15fbf4846580d3e5f156e5ff9ac2fbff31327004a8593f581eaeb14f67a36412a8a22017f4284347ba51
- TLSH
  T15D413987F00DDE46B08DA87EFC5AA6F5601BD8C35DE1D452539788E4C84EDAE8C4E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
behavioral22 behavioral23
- Target
  zapret-discord-youtube-1.9.9d/general (ALT6).bat
- Size 3KB
- SHA256 8ef1e5f6ae38a7a288ba1516293eda9183d7f265210897399f911d8a1e7e62fe
- MD5 e6973238d03286140e2469f9616c9edc
- SHA1 a01e8061bfc7cb2b93aca815ebcd85bc46145ed7
- SHA512 28f8aacc46144648af1d03ede61d4983ee0942469526c49d86c633b63b52b2aeb80ab57b459775ac2b0ef975d1d822907b93171c4999952aecc934a98022d06a
- TLSH
  T144612753E00DDE4AB68FB83FF85EA6E52017C8C35CD6D452539B89E8C84FDBA494E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral24 behavioral25
- Target
  zapret-discord-youtube-1.9.9d/general (ALT7).bat
- Size 3KB
- SHA256 26b4dd29e5020066660230cf5ea61693dd85b69d15fc11ac967f3adf54fb352f
- MD5 a8efa3ed6068b339fd86951c80e84c2f
- SHA1 19b7620ecab1c14492f9576defcecadb6589edf5
- SHA512 3aba9edd1a5369486b647d60c003bf098d9d45decc76c9a251543934e5ceaae3966c52d6af562a6c733177212d7c5e32534dcd8207d1e1975a8cadaacf3f3f8d
- TLSH
  T1CD513793F00DDE46B68EA83EFC9AA5F52017C8C35CD6D462539789E8C84EDBE4D4E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral26 behavioral27
- Target
  zapret-discord-youtube-1.9.9d/general (ALT8).bat
- Size 3KB
- SHA256 8612e0b0d5eb757448c4d2ef255abc00ff30f2b7e9087e0c936f7ba479af07e5
- MD5 a2865133b7b6bc0adcc51acb7d64ae20
- SHA1 5ccf2ac6e98ef57e60adaef840104f94035f776a
- SHA512 e0f5aaf76637c1a1934a1eba13e35f6cae87c83741ae26b594ee7ef9e9d1b894f75224992b67f82e48577d009187a2152e0475faedec4a7a0b1410bfd3d06329
- TLSH
  T162616A93E00CDE46B58CA83EF85FA6B42127DCC32CD2D452539B88F8D84EDBE584E584
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral28 behavioral29
- Target
  zapret-discord-youtube-1.9.9d/general (ALT9).bat
- Size 3KB
- SHA256 4b8f50bd2b5cd71c0a883461d4a526a2cd9494a87847907807d06c233166c2c9
- MD5 4d6ced8c4790b06aba64d176a2ba5e9a
- SHA1 4ea98386b069cc339e301da4ce8c777a81fb0111
- SHA512 71a6234afd9e08d6999d90b765bba7781063a8e76fee8e8793be0a17b31e4bcea4342da6e4eefd4e7e42ce1edf39d9c1c58120af79e56b45d8337ec8b082c099
- TLSH
  T170616A93E00DDF46B48D6C7EF89BA5B52017C8872CD6D852539789F8C44EDAE5C4F085
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral30 behavioral31
- Target
  zapret-discord-youtube-1.9.9d/general (FAKE TLS AUTO ALT).bat
- Size 3KB
- SHA256 0a3744d9a42dd439b3576fa1d031d3d2ef6f93564bdb575a6afb0c8a3a056ac2
- MD5 6545370a3d960f825186816b546b2bf2
- SHA1 397fcb6722760551b1154c9f77de5ad751760d63
- SHA512 de312677efa8c70f2b3d31560e762e85f1cecb3c2b33e1a25f10576ee235edfc4b21d5e825d132acc1784bdb8f91bf8f164b79dd048f869bd6a77c6c5702c6d1
- TLSH
  T1BE715D93E00DDE47F68D683EFC5FA6A52027C8832CD2C851839B84E8D84EDBE5C4E584
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect SalatStealer payload

Family: salatstealer

UAC bypass

Badlisted process makes network request

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Deobfuscate/Decode Files or Information

Drops file in System32 directory

Detect SalatStealer payload

Family: salatstealer

UAC bypass

Badlisted process makes network request

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Deobfuscate/Decode Files or Information

Drops file in System32 directory

Detect SalatStealer payload

Family: salatstealer

UAC bypass

Badlisted process makes network request

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Deobfuscate/Decode Files or Information

Drops file in System32 directory

Detect SalatStealer payload

Family: salatstealer

UAC bypass

Badlisted process makes network request

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Deobfuscate/Decode Files or Information

Drops file in System32 directory

UPX packed file

Detect SalatStealer payload

Family: salatstealer

UAC bypass

Badlisted process makes network request

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Deobfuscate/Decode Files or Information

Drops file in System32 directory

Detect SalatStealer payload

Family: salatstealer

UAC bypass

Badlisted process makes network request

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Deobfuscate/Decode Files or Information

Drops file in System32 directory

Detect SalatStealer payload

Family: salatstealer

UAC bypass

Badlisted process makes network request

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Deobfuscate/Decode Files or Information

Drops file in System32 directory

UPX packed file

Detect SalatStealer payload

Family: salatstealer

UAC bypass

Badlisted process makes network request