salatstealer | 75af11b6a3e729e58ded9f385014c28ae2ee8bf8203ff9fdf53542d294f91ffb

General

Target
2026-08-15_920ab3e49d7cd235a3a065ee861f909e_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch
Size 11.1MB
Sample260815-k55psahn4v
SHA256 75af11b6a3e729e58ded9f385014c28ae2ee8bf8203ff9fdf53542d294f91ffb
MD5 920ab3e49d7cd235a3a065ee861f909e
SHA1 43f27b68c8eefcda8b043b1470c1d906ff623c15
SHA512 fb5e3fe97d72865421f0fd54979f1e3acb9e7ce3d98a6c38727679c5e3cb8c890bc51226cd475944a269109774255f3cf09d03afb253b31368626a4fd3a47811
SSDEEP 49152:5egeyNolEPiLetPOQt4/WBHcWeVbkZkN4MxpR6Ng/JFfx5xZEYCipf3B6e2j5unJ:IJyNoLegleByUwpF6q
TLSH
T193C65B41FA8B94F5E9031831816FB23F63309D048B68DB9BEB543F6AFC776D1196A205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_920ab3e49d7cd235a3a065ee861f909e_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch
- Size 11.1MB
- SHA256 75af11b6a3e729e58ded9f385014c28ae2ee8bf8203ff9fdf53542d294f91ffb
- MD5 920ab3e49d7cd235a3a065ee861f909e
- SHA1 43f27b68c8eefcda8b043b1470c1d906ff623c15
- SHA512 fb5e3fe97d72865421f0fd54979f1e3acb9e7ce3d98a6c38727679c5e3cb8c890bc51226cd475944a269109774255f3cf09d03afb253b31368626a4fd3a47811
- SSDEEP 49152:5egeyNolEPiLetPOQt4/WBHcWeVbkZkN4MxpR6Ng/JFfx5xZEYCipf3B6e2j5unJ:IJyNoLegleByUwpF6q
- TLSH
  T193C65B41FA8B94F5E9031831816FB23F63309D048B68DB9BEB543F6AFC776D1196A205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery salatstealer stealer credential_access defense_evasion spyware trojan
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Drops file in System32 directory
behavioral1 behavioral2