salatstealer | 3ae9f263c7a093592db83592768848686292828e0bdf80706f85f3e882b8c818

General

Target
tgWsproxy.exe
Size 37.7MB
Sample260809-pn6b7seq51
SHA256 3ae9f263c7a093592db83592768848686292828e0bdf80706f85f3e882b8c818
MD5 e2f9584c8db75f3924c1f838ca571580
SHA1 d55aa9375ff8844ebf905739dea455053fdcc49b
SHA512 1fe44c5075e2b287eda3a9214ba904c4c6023261dd1b4ee504df9ce98bc373d8cfcb9f00efcb77fc81bdff4cf7c16c2c6c5bae69c95eb1dc6fd7c373dc99697f
SSDEEP 786432:5gb14ctpWcGIht74USVzcA1Mcy7h7Lgq4U3nA25S:khSDSdxt
TLSH
T1A18733C79C05AA3438F257F7DA4B6FE720E2EC5C3A6A01B1058391A50F6F469FEE0561
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  tgWsproxy.exe
- Size 37.7MB
- SHA256 3ae9f263c7a093592db83592768848686292828e0bdf80706f85f3e882b8c818
- MD5 e2f9584c8db75f3924c1f838ca571580
- SHA1 d55aa9375ff8844ebf905739dea455053fdcc49b
- SHA512 1fe44c5075e2b287eda3a9214ba904c4c6023261dd1b4ee504df9ce98bc373d8cfcb9f00efcb77fc81bdff4cf7c16c2c6c5bae69c95eb1dc6fd7c373dc99697f
- SSDEEP 786432:5gb14ctpWcGIht74USVzcA1Mcy7h7Lgq4U3nA25S:khSDSdxt
- TLSH
  T1A18733C79C05AA3438F257F7DA4B6FE720E2EC5C3A6A01B1058391A50F6F469FEE0561
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware credential_access defense_evasion discovery execution salatstealer persistence privilege_escalation pyinstaller spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1