salatstealer | 4dfe09646e75bc19e563988038b24dc7dfbd67e3ae47b088a915727684b0696f

General

Target
Xeno-Release-V4.1.5a-Updated-X64.zip
Size 1.2MB
Sample260821-cxffxs1crd
SHA256 4dfe09646e75bc19e563988038b24dc7dfbd67e3ae47b088a915727684b0696f
MD5 ff2a7bb98e69b5aa9905dc2c266cd46f
SHA1 cb4a87f2315ba88f54ca2f7279e4e788deda8fb2
SHA512 28a1ff7d5382758f166407462c8a642665cf996f1c34bcc50897c92b2616aaf7316943ba519cc50aa39f1ff3adccf6cb2a858d24ab1c0457530b61c8f33857df
SSDEEP 24576:JhI0vD7y4oF/zBO2L39VPGdgrbosOQtfML190uMzNpi7Z6Nm:LdC4Kw2L391Esht0RiuMxpi16Nm
TLSH
T1B65533BA9D52187BDC362BBF70400C5231A0F967C3CF1B698369488A47BDD416ADFB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Xeno-Release-V4.1.5a-Updated-X64/Bootspraprer.exe
- Size 334KB
- SHA256 f306f8e09c08ab4dbd161528a5943ce2a0e154e294a1bb3178104e7baa942ea9
- MD5 c1238d87e88fe56caf0640f69ab7ddbb
- SHA1 24e8c4a08322d49e1e9c24784914f2c3f90a6b9d
- SHA512 666f3e0f4396811bb32b6d7e7f241c894f9305682c1fdf8084495310142d7b861bba3bdcb6168f6401afa28edcc9ea1081df7fcd5fffe83f4942a9b9bf591c1f
- SSDEEP 6144:i+CpcbL3UZ6JQJ62ZXZhEb7Hcqh8lIFWoJoZGXkOiY:A6jyJ62tgb7Hb6+D7
- TLSH
  T153747D19F7A514FDE5678138C8424906E7B2BC1647A0E7CF23E04AA62F277D19E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  Xeno-Release-V4.1.5a-Updated-X64/database/NlsData0002.dll
- Size 1.9MB
- SHA256 ad42d2d8fa890536b8a05bb50103a3ae3e32e041c478ceff55b7a66642ff2bb2
- MD5 068bdc064c89460104aa87b63796db12
- SHA1 69ae1feb6aa2cc9727265c3174561dff4f43eed9
- SHA512 b1b1617b4a910927a4a558ebe1e0b7d874502a636b81109225e7a6b583b80d4fb98aab1ad8bf5fab97ca602c5288d73bfcadc716d3e85699a35a33e5c51ceed3
- SSDEEP 24576:kpHWcAbes/4jtCJ1EOAQ4HQWMxYlKpXLFVIN:5cAbF/lbElQRWMxYlKzVI
- TLSH
  T18B95C3F8B92A8C27EFFBC83495A837A86443C4C5934C5099E5CBCD748599EF83096277
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Xeno-Release-V4.1.5a-Updated-X64/database/cache/memory/NlsData0011.dll
- Size 2.6MB
- SHA256 0c28e98d97e39e7b0b0f3d03545a0943337aba8c31aa82b6f1cb986aec716cd3
- MD5 878109bb8b9cd3c97b634feedd5c3ef2
- SHA1 342a5439d825dc1ceaa22ed61b437e269a932955
- SHA512 9687a5ef20eaf311f7416aa10e9e2d6ab768a4957f14028794fd06db047d7e43f182c1c55b4bc51b4863febacf968180598a4b2d45dab2261491403b9fd1e8ab
- SSDEEP 12288:A1V/RYpi1n21/NQb5IWaT3nKm/x31dArjB/Cdv3fdjapMDT5Zpd9Q888888X888B:A1DmN1GKDT6wX8XY/KIRH
- TLSH
  T129C52E8BFDFAA572F79AC2B0A4E4635E14337604E713D059B0E940981C933D2D466BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6