General
- Target windivert.exe
- Size 3.4MB
- Sample260820-yhlv2shr7s
- SHA256 8f7338402cd66a98c73c3fd3da32d2fbcaac7ed83482f538bff433cf8d63d2a5
- MD5 8d3f36da906eea9cf8a1e013288da4a4
- SHA1 47e414f19ad94a79292c8e281ed2589571ac051d
- SHA512 d379146cbdb20d0854686c0c40d152dcf0ab9b8e32d195b282d6464e8e3ced22670818ea9ac55e29cc7aadccf1d902bef26f1b2fdea7243c57ab0d52d6d6c06f
- SSDEEP 98304:4cyenONbsXRFJpo9cB9L79iwvMvSXyCo:TyHNAXMGpMvP
- TLSH T14BF5332F90C8E58FFFEF553FA622D7A0A109C1B7BFC9C9A80D684D4741462ACAF45251
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
windivert.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
windivert.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target windivert.exe
- Size 3.4MB
- SHA256 8f7338402cd66a98c73c3fd3da32d2fbcaac7ed83482f538bff433cf8d63d2a5
- MD5 8d3f36da906eea9cf8a1e013288da4a4
- SHA1 47e414f19ad94a79292c8e281ed2589571ac051d
- SHA512 d379146cbdb20d0854686c0c40d152dcf0ab9b8e32d195b282d6464e8e3ced22670818ea9ac55e29cc7aadccf1d902bef26f1b2fdea7243c57ab0d52d6d6c06f
- SSDEEP 98304:4cyenONbsXRFJpo9cB9L79iwvMvSXyCo:TyHNAXMGpMvP
- TLSH T14BF5332F90C8E58FFFEF553FA622D7A0A109C1B7BFC9C9A80D684D4741462ACAF45251
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detect SalatStealer payload
-
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
Executes dropped EXE