salatstealer | 676fa55a222bf4403ded2073aa3a7a650db1448ee293eef4d50da8f246db68be

Sharing

Copy URL Twitter E-mail

General

Target
Rapid 0R.zip
Size 3.7MB
Sample260816-srqmpsdn8x
SHA256 676fa55a222bf4403ded2073aa3a7a650db1448ee293eef4d50da8f246db68be
MD5 8d0227f0fd1a2f1351311e2459c08c8c
SHA1 f22ac1e2f177420dffb49bc8fca87791f21395b2
SHA512 532c2ca0c92d02a850f0ce15f18ec99f60afeafa6255311138ded9cb0e8ebbf5b7d62a61c2ec68c727796883a862c8e55af3464f56c855afff405e76b3c9f1a2
SSDEEP 98304:dUsJpEdBU/oEo72zswQXmRo+GupwtxiXzOMVg:dUupEdqQn7XwKmRo+6txiXzOMVg
TLSH
T1FA0633370D1A090E6B877BEABE270F5D2C665DE214A552E0CBAF5D6C93E1307F9B1090
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Rapid 0R.zip
- Size 3.7MB
- SHA256 676fa55a222bf4403ded2073aa3a7a650db1448ee293eef4d50da8f246db68be
- MD5 8d0227f0fd1a2f1351311e2459c08c8c
- SHA1 f22ac1e2f177420dffb49bc8fca87791f21395b2
- SHA512 532c2ca0c92d02a850f0ce15f18ec99f60afeafa6255311138ded9cb0e8ebbf5b7d62a61c2ec68c727796883a862c8e55af3464f56c855afff405e76b3c9f1a2
- SSDEEP 98304:dUsJpEdBU/oEo72zswQXmRo+GupwtxiXzOMVg:dUupEdqQn7XwKmRo+6txiXzOMVg
- TLSH
  T1FA0633370D1A090E6B877BEABE270F5D2C665DE214A552E0CBAF5D6C93E1307F9B1090
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Rapid 0R/Rapid 0R/READme.txt
- Size 199B
- SHA256 71b25fab4180d8861050e1198f44373445eb40b3a3a0078d0d41529a81e566be
- MD5 b76a14f411c5c277248690db114cde4d
- SHA1 7c1d1ba39f9492ab78e33c3a089ecfe60d238e33
- SHA512 abf9a8817a0874073acbbbec083b8acb4397071045cf2df7c7d33f638858a246a402de355d9569712819e6aef4630bf85d59c11015dc4e47b485cf71cc4763e0
- TLSH
  T11DD0235E2C9AD45C478234458428C400FB0090C5916C2480547C12D653766B753355FB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Rapid 0R/Rapid 0R/Rapid.exe
- Size 3.4MB
- SHA256 6f05ef23904b3ce24fc6fd9410302efd8b80c2e495265e55fe024d3b96ea59ec
- MD5 ccbe8fd248fa2c00eae9be3b96ab2c2b
- SHA1 9321fc8e3fd380441e6ae6b327019c67f20cecff
- SHA512 17967f14d28f6b3ccd1541fda5ee68b2168e883228c3f1aac17b9c210521e1844ac32e91093c0e2d760887759d06a586b5c2f39db7016451a56f80375d22b39c
- SSDEEP 49152:dmmt+WFGXj87h9B48MfHhN1b/vUDY+UEXn2IWwyb2ggN9ya6HoocZuZHVyo:dd2Lf5T+vXMb2AHTsu5V
- TLSH
  T17DF533DC9A7CFFABD7E4DBB1141750DF8290850EA9F3614610924E2885C3ABD13A56FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery salatstealer spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  Rapid 0R/Rapid 0R/data/configs.txt
- Size 49.2MB
- SHA256 8bbbb455a79d64bdc9452bc71845409bf588260bac739fc18b8920a7a1c80f98
- MD5 8f236bdf1d8f918957235893d53cf3f5
- SHA1 c0c58fe07d4abd40dc3da2e73b61f90b745e9e30
- SHA512 bd8f064175bf064d8f8198ed48165de3e0d60df2ab5d3e74ea51ef3fa9e9dd8a9ca7af4deabcacbb2db545337bcbdf76cc76f86bb823bc2690a334cafd485411
- SSDEEP 1536:R7777777777777777Q777777777777777777777777777777777777777777Q77/:h
- TLSH
  T1F6B7DB59612719CE1AB3A375DC137081FB1B403B87A4A350B82FA245AF78970C9F5EED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8