General
- Target Rapid.exe
- Size 3.4MB
- Sample260804-b7snkaba44
- SHA256 2306b3a8fa9e128165239c731a1413fd525cf97a862a98de88a678a4fabf1571
- MD5 544d8a6f697148c8b6ae2a6e2bb8585c
- SHA1 3ed5d037f6748e9b5596d5fdacfd3f453e11b195
- SHA512 29f08a02573f8e12d0d99579a2914f4a355022ab9a9aad9eed5a39dbc117690ab738a7893fe9ea09c569f7a61b8d41ed21849748b09e5f62b5d6907b083ac8dc
- SSDEEP 98304:u6DxNYlv0dLU7N3AkY6qqikVAbv+dtwMCJgIxIio:dxN6caJ5Y1qiFbmi/o
- TLSH T186F5335E05FAD40BC4BC6935249153AC0E3BB6F5C6AE0340691D7B3A7BEB8E2E7C1095
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
Rapid.exe
Resource
win10v2004-20260513-en
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
Rapid.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target Rapid.exe
- Size 3.4MB
- SHA256 2306b3a8fa9e128165239c731a1413fd525cf97a862a98de88a678a4fabf1571
- MD5 544d8a6f697148c8b6ae2a6e2bb8585c
- SHA1 3ed5d037f6748e9b5596d5fdacfd3f453e11b195
- SHA512 29f08a02573f8e12d0d99579a2914f4a355022ab9a9aad9eed5a39dbc117690ab738a7893fe9ea09c569f7a61b8d41ed21849748b09e5f62b5d6907b083ac8dc
- SSDEEP 98304:u6DxNYlv0dLU7N3AkY6qqikVAbv+dtwMCJgIxIio:dxN6caJ5Y1qiFbmi/o
- TLSH T186F5335E05FAD40BC4BC6935249153AC0E3BB6F5C6AE0340691D7B3A7BEB8E2E7C1095
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect SalatStealer payload
-
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
UAC bypass
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Executes dropped EXE
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3