Extracted

• • Target
    modbroker.exe
  • Size 3.4MB
  • SHA256 51280b264540b8db04302bed59df878d88fb397ccc6ad4b6d7b6a837e23d9d23
  • MD5 c781d5575b6a15b884a6672383e86c05
  • SHA1 1b70b326a4171acf0f8a563e7279e07ac1d7963b
  • SHA512 43cc2377b38aac9a85410ede04d9aa7e8cc2a7ffdd06314cadbb9e70b1b93a9bb4c956dc6b58357fe49e899f3a7eef9d0f049ec0c529159178e89e034b2c236c
  • SSDEEP 98304:rV8Wa9DmGZF2xYR/dHgfuF1qPh9MTspZZcvItXgY+:hWDpP2ChxUPh9MoPQ5
  • TLSH
    T191F5330B463416E1F5F4BC77CAF24681C80763627BA96F835E5FD6EA46042229FEE04D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoverysalatstealerspywarestealerupxexecutionpersistenceransomware

  • Detect SalatStealer payload

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2