salatstealer | 2026-08-15_fe72e7666c60477979078c1fb7a2ce7d_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_fe72e7666c60477979078c1fb7a2ce7d_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch
Size 10.8MB
Sample260815-dhfc2sde53
SHA256 8a556575a2a6f3a9b8807be842cdb030a4d60d1538c19ded7624864f4625b0a8
MD5 fe72e7666c60477979078c1fb7a2ce7d
SHA1 cc68361d802d37a83f4e87bce1dd22ba74d64a62
SHA512 b5b34524f2979d162722c888c3e08085442ff7959c4e6fc95bfda4556223fbebdf3915b6a6b8ca3ce7a2eb0f16f2c8264c0d1502bb070ab641b77cbd91b33572
SSDEEP 98304:cdU3v+iL1/hG9ONf9egcsMAMc0ooipGKP/Obxvim/Z4:uPTFrc0CGKP/Obxvimq
TLSH
T160B65B41FA8B48F6E9035871409BB33F67315D048B28DBDBE7547B2BF877691293A608
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer salatstealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
sample	family_salatstealer

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_fe72e7666c60477979078c1fb7a2ce7d_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch

File Explorer

2026-08-15_fe72e7666c60477979078c1fb7a2ce7d_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch

.exe 10.8MB

2026-08-15_fe72e7666c60477979078c1fb7a2ce7d_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch

SHA256 8a556575a2a6f3a9b8807be842cdb030a4d60d1538c19ded7624864f4625b0a8
MD5 fe72e7666c60477979078c1fb7a2ce7d
SHA1 cc68361d802d37a83f4e87bce1dd22ba74d64a62
SHA512 b5b34524f2979d162722c888c3e08085442ff7959c4e6fc95bfda4556223fbebdf3915b6a6b8ca3ce7a2eb0f16f2c8264c0d1502bb070ab641b77cbd91b33572
SSDEEP 98304:cdU3v+iL1/hG9ONf9egcsMAMc0ooipGKP/Obxvim/Z4:uPTFrc0CGKP/Obxvimq
TLSH
T160B65B41FA8B48F6E9035871409BB33F67315D048B28DBDBE7547B2BF877691293A608
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detect SalatStealer payload
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

435664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.6MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

218KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_fe72e7666c60477979078c1fb7a2ce7d_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch

generic