salatstealer | df53c108f4ea0c1f40225cc3d1f073f88e97d14fb4bbee6b7884ae0a008fe456

General

Target
2026-08-07_ed753284c13d9bd6922ac3772b6800fb_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
Size 12.0MB
Sample260807-3pc9psae67
SHA256 df53c108f4ea0c1f40225cc3d1f073f88e97d14fb4bbee6b7884ae0a008fe456
MD5 ed753284c13d9bd6922ac3772b6800fb
SHA1 593e51840069ac4c0d2e9a1f0727224ce2edfa3d
SHA512 ad215a093f48b251630ca23388f0c635e91bd67e9b7e4d862e06e374b4459d488f5363065c997bb51fc6f28b926dabc3c1287f0a3638c92ed412be86adc15b7e
SSDEEP 49152:mlVyPtHu+MFkFJ8P395ZnG9CMyGvjgZAJYFQaOSjd7NVyWW4hNv3ZcyFr42tPhjQ:syFH6P3b5MCwv/PUDtvJ4fIEOO/
TLSH
T166C65C11FACB54F6F9036831416BB37F23315D048B28DB9BEB583B6AF877691186A305
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-07_ed753284c13d9bd6922ac3772b6800fb_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch
- Size 12.0MB
- SHA256 df53c108f4ea0c1f40225cc3d1f073f88e97d14fb4bbee6b7884ae0a008fe456
- MD5 ed753284c13d9bd6922ac3772b6800fb
- SHA1 593e51840069ac4c0d2e9a1f0727224ce2edfa3d
- SHA512 ad215a093f48b251630ca23388f0c635e91bd67e9b7e4d862e06e374b4459d488f5363065c997bb51fc6f28b926dabc3c1287f0a3638c92ed412be86adc15b7e
- SSDEEP 49152:mlVyPtHu+MFkFJ8P395ZnG9CMyGvjgZAJYFQaOSjd7NVyWW4hNv3ZcyFr42tPhjQ:syFH6P3b5MCwv/PUDtvJ4fIEOO/
- TLSH
  T166C65C11FACB54F6F9036831416BB37F23315D048B28DB9BEB583B6AF877691186A305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery salatstealer spyware stealer
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1 behavioral2