salatstealer | 0d303d5a9e2b6c30915cfd4d13a62a42718a07e131c378c7e3490e8d735aa3b6

General

Target
2026-08-04_bba43d71bb225f1d6f6d0c0a160e72ff_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 11.0MB
Sample260805-ap9cxsthmb
SHA256 0d303d5a9e2b6c30915cfd4d13a62a42718a07e131c378c7e3490e8d735aa3b6
MD5 bba43d71bb225f1d6f6d0c0a160e72ff
SHA1 13fdb6596cf1ab24dffb3857b7e70b376a7d8e0c
SHA512 a8a3e56da63d3dd86edec57b50ee368fb4980654421d3572d18f254990388948d18c24fa35e20ca4cf434df5991884d06c521ed510ae68599299162328b90c51
SSDEEP 196608:Q4F7Sg2YUDn25oJDQugyGntJefybUQsEgD1uC74c:Q4F7SoUj2UuyOje6yEgDcCUc
TLSH
T1D8C6BE07EC9115E9C0AAE2358A669153FB717C485B3123D72BA0F7382F76BD0AE79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-04_bba43d71bb225f1d6f6d0c0a160e72ff_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 11.0MB
- SHA256 0d303d5a9e2b6c30915cfd4d13a62a42718a07e131c378c7e3490e8d735aa3b6
- MD5 bba43d71bb225f1d6f6d0c0a160e72ff
- SHA1 13fdb6596cf1ab24dffb3857b7e70b376a7d8e0c
- SHA512 a8a3e56da63d3dd86edec57b50ee368fb4980654421d3572d18f254990388948d18c24fa35e20ca4cf434df5991884d06c521ed510ae68599299162328b90c51
- SSDEEP 196608:Q4F7Sg2YUDn25oJDQugyGntJefybUQsEgD1uC74c:Q4F7SoUj2UuyOje6yEgDcCUc
- TLSH
  T1D8C6BE07EC9115E9C0AAE2358A669153FB717C485B3123D72BA0F7382F76BD0AE79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery salatstealer stealer credential_access spyware
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1 behavioral2