Analysis
- max time kernel
30s - max time network
32s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 19:00
Behavioral task
behavioral1
Sample
SearchApp.exe
Resource
win10v2004-20260513-en
9 signatures
30 seconds
Behavioral task
behavioral2
Sample
SearchApp.exe
Resource
win10ltsc2021-20260513-en
8 signatures
30 seconds
Behavioral task
behavioral3
Sample
SearchApp.exe
Resource
win11-20260513-en
4 signatures
30 seconds
Behavioral task
behavioral4
Sample
SearchApp.exe
Resource
win11ltsc2024-20260710-en
4 signatures
30 seconds
General
- Target SearchApp.exe
- Size 3.4MB
- Sample260804-xn2b9afe34
- SHA256 1124e56be33b18e51d0f5ec29f6f92648bbc936ed9b610c738913af1379dba98
- MD5 5317bfca88592896b9cf2cf263fb05bd
- SHA1 0d4df9094e8008f08127b92d9c3f1eda2f293de6
- SHA512 7ef2b6ef8ba3ef7e8cba895e04a0dde63994e5f9c09d479e14268d3b60037b317d89f4d0f8dd2ef0d39aca7cef798c624151a6fd34cca4b25e5e8446f7d4b9d0
- SSDEEP 49152:yl4+bHmuMVApuhjdya6HLpzlRKHIIZ4wc0ehiP1k5KpjlBzwQLuvvCLUBsCqp:SXuBdGr5rWIsJ/1oWjiKyep
- TLSH T16DF5337D0E589A70F47D08FC4A2A32CD733A2AC04A261D16769D0F699B45E3D1C97FE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 2 IoCs
resource yara_rule behavioral4/memory/5792-1-0x0000000000680000-0x00000000012D7000-memory.dmp family_salatstealer behavioral4/memory/5792-2-0x0000000000680000-0x00000000012D7000-memory.dmp family_salatstealer -
resource yara_rule behavioral4/memory/5792-0-0x0000000000680000-0x00000000012D7000-memory.dmp upx behavioral4/memory/5792-1-0x0000000000680000-0x00000000012D7000-memory.dmp upx behavioral4/memory/5792-2-0x0000000000680000-0x00000000012D7000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SearchApp.exe