salatstealer | d06632758b30ee4fa0bf95b532bcd6b8d8ea2fedccf180b4204055c369623042

General

Target
2026-08-20_356730a32f00f7ea581e79d5074866f5_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch
Size 11.1MB
Sample260820-gsdtrafl2y
SHA256 d06632758b30ee4fa0bf95b532bcd6b8d8ea2fedccf180b4204055c369623042
MD5 356730a32f00f7ea581e79d5074866f5
SHA1 2bbd09cc846e1b3ece3037fe9cc15e2892ad2238
SHA512 fa39b04d0acb14bbda05dc97c5032dec4e773cdf5bcf91ba9a3ae7a530b7994f0b6926073e7f4256ca04ea80d6993f307adbbbbefd9be04c0e156f0673a87a1f
SSDEEP 49152:IVlasHTPIgn1KQFqytkU2S/XXasxqyASRncs0gRQSNY+WUILm2PaCmPcXeAQC5wk:EksHTPKXh1gRO+WTiPuLeLNFpb
TLSH
T1FEC65A11FA8B54F5E9031831415BB23F63315E048B68DBEBFB187F6AFC7B691192A205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-20_356730a32f00f7ea581e79d5074866f5_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch
- Size 11.1MB
- SHA256 d06632758b30ee4fa0bf95b532bcd6b8d8ea2fedccf180b4204055c369623042
- MD5 356730a32f00f7ea581e79d5074866f5
- SHA1 2bbd09cc846e1b3ece3037fe9cc15e2892ad2238
- SHA512 fa39b04d0acb14bbda05dc97c5032dec4e773cdf5bcf91ba9a3ae7a530b7994f0b6926073e7f4256ca04ea80d6993f307adbbbbefd9be04c0e156f0673a87a1f
- SSDEEP 49152:IVlasHTPIgn1KQFqytkU2S/XXasxqyASRncs0gRQSNY+WUILm2PaCmPcXeAQC5wk:EksHTPKXh1gRO+WTiPuLeLNFpb
- TLSH
  T1FEC65A11FA8B54F5E9031831415BB23F63315E048B68DBEBFB187F6AFC7B691192A205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery salatstealer spyware stealer
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1 behavioral2