salatstealer | f306f8e09c08ab4dbd161528a5943ce2a0e154e294a1bb3178104e7baa942ea9

General

Target
2026-08-20_c1238d87e88fe56caf0640f69ab7ddbb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 334KB
Sample260820-ywb8rsvblf
SHA256 f306f8e09c08ab4dbd161528a5943ce2a0e154e294a1bb3178104e7baa942ea9
MD5 c1238d87e88fe56caf0640f69ab7ddbb
SHA1 24e8c4a08322d49e1e9c24784914f2c3f90a6b9d
SHA512 666f3e0f4396811bb32b6d7e7f241c894f9305682c1fdf8084495310142d7b861bba3bdcb6168f6401afa28edcc9ea1081df7fcd5fffe83f4942a9b9bf591c1f
SSDEEP 6144:i+CpcbL3UZ6JQJ62ZXZhEb7Hcqh8lIFWoJoZGXkOiY:A6jyJ62tgb7Hb6+D7
TLSH
T153747D19F7A514FDE5678138C8424906E7B2BC1647A0E7CF23E04AA62F277D19E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-20_c1238d87e88fe56caf0640f69ab7ddbb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 334KB
- SHA256 f306f8e09c08ab4dbd161528a5943ce2a0e154e294a1bb3178104e7baa942ea9
- MD5 c1238d87e88fe56caf0640f69ab7ddbb
- SHA1 24e8c4a08322d49e1e9c24784914f2c3f90a6b9d
- SHA512 666f3e0f4396811bb32b6d7e7f241c894f9305682c1fdf8084495310142d7b861bba3bdcb6168f6401afa28edcc9ea1081df7fcd5fffe83f4942a9b9bf591c1f
- SSDEEP 6144:i+CpcbL3UZ6JQJ62ZXZhEb7Hcqh8lIFWoJoZGXkOiY:A6jyJ62tgb7Hb6+D7
- TLSH
  T153747D19F7A514FDE5678138C8424906E7B2BC1647A0E7CF23E04AA62F277D19E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2