salatstealer | 9798e2ec0e7b461e616553ffc4443d3ddddf026b57b92c77e40e9e065df1c1e7

General

Target
loader.exe
Size 3.6MB
Sample260805-te84yscc58
SHA256 9798e2ec0e7b461e616553ffc4443d3ddddf026b57b92c77e40e9e065df1c1e7
MD5 a7b9c128d28935944b9fd86ad62ddf99
SHA1 b3cc0b1eab399229c5cd153acb54df08ed268617
SHA512 89476cec9cbc887554493096a086c040c88d1ee25648d86bd8b05009050bc63d1400577c313a75d309fc28f423d511f9b6b1b64b9d60d0d6bec5e8bd6a354eda
SSDEEP 49152:b1Fw9ukqoIAVDHqbTmy+/33BG2w3Ey4o4UwAq8IIJSLABSCmDZsNJqAWGHuXagZl:bT0ukWb/FP3EtgfJSUBSCmDyJlHix
TLSH
T1D306338E645D38E2DABB11B0782E3A840910EDB01FC4D9D5CDEC139BBBD3D945E6A44B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  loader.exe
- Size 3.6MB
- SHA256 9798e2ec0e7b461e616553ffc4443d3ddddf026b57b92c77e40e9e065df1c1e7
- MD5 a7b9c128d28935944b9fd86ad62ddf99
- SHA1 b3cc0b1eab399229c5cd153acb54df08ed268617
- SHA512 89476cec9cbc887554493096a086c040c88d1ee25648d86bd8b05009050bc63d1400577c313a75d309fc28f423d511f9b6b1b64b9d60d0d6bec5e8bd6a354eda
- SSDEEP 49152:b1Fw9ukqoIAVDHqbTmy+/33BG2w3Ey4o4UwAq8IIJSLABSCmDZsNJqAWGHuXagZl:bT0ukWb/FP3EtgfJSUBSCmDyJlHix
- TLSH
  T1D306338E645D38E2DABB11B0782E3A840910EDB01FC4D9D5CDEC139BBBD3D945E6A44B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware bootkit defense_evasion discovery execution salatstealer persistence spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Stops running service(s)
  defense_evasion execution
- Suspicious clipboard content.
  A suspicious script was copied to clipboard.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2