salatstealer | 632097437cb415d6f8860ef1fafafa4b25301185c92ab7ac2962baa605a2ebda

Sharing

General

Target
cherax.zip
Size 11.0MB
Sample260821-yesjesdb33
SHA256 632097437cb415d6f8860ef1fafafa4b25301185c92ab7ac2962baa605a2ebda
MD5 c6752c0369ad03ce7c00619456bff433
SHA1 bf885d4c394ff831f50af3c211f918f025a1abc8
SHA512 4283ace62860a7ac9263600d68d666abcb51714f3bc152f1a9308bf22547ff6364dfe65ff945d1cd9a8b094b26b32f3477632d9fb508fa2104ec8e91e08f3eb3
SSDEEP 196608:x70zgGDnz09zKTqYmGwP/N+NcBROMIDdrrJ8W5RXn22Px+C6q:KDzGKTqYHm+NcmDdKWbn22PF5
TLSH
T1CEC6336AACC8499786F54156AB970217DB8995708EFAB53C35D80CB3BCCBCFE8731460
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  cherax/Microsoft.Win32.Primitives.dll
- Size 25KB
- SHA256 191ce24960a2d1b22d6333f85bffe1c7050fe920c558cd39e51e48174e86b391
- MD5 6a4c1f080d584323d1775d490b33b299
- SHA1 8c0caa3928f6056021337c752836546ec0253451
- SHA512 7398d6925951937f680ddf6df7a5b925b923db09a714216be37ca9bf3228e5d749b7328040a54b2102f70fa15e89f4c51ebb61aa89451f858438eeacc5b247a9
- SSDEEP 768:v7jm5n5XKRK1hDGE0nAojNEuLSoQuSg5i9:v7i1QK1RGvDpL7SV9
- TLSH
  T11FC27C398F804762F879ABB2D8FA5A156DB5F2815B4289CF101940CE5F83B866F3427D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  cherax/System.Collections.NonGeneric.dll
- Size 98KB
- SHA256 702eba63368c2cd0c12321763913e8661805ff3506d49fc4499c38da93c9cf90
- MD5 077bc4a5f02a6cf985e5c22f1fb7119d
- SHA1 4b1af9f92a773c088c6864879b6a2b10e7c35bba
- SHA512 6b538f0d41151294fe6973d2eea2370cdccfc7bc8e851c62d2261c1021bcd25241fd79074c86f103ef2dfd6fbb7b04ddd513baaf229f0ecc69b8f80c2554e548
- SSDEEP 3072:ZdjNExgJvRQWsBTkyo+XBQCUeHLDrm6YpfSL:/CxgJvbAAi
- TLSH
  T124A3281173980392DA5E91BCD9A38A61C2B1F4E32B13D1CF1A04D5CE5E6BBC36BB4617
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence
behavioral2
- Target
  cherax/System.Collections.dll
- Size 258KB
- SHA256 05b1364b1f6e37f089e46db060e0708a5d2cbd6da2d795cf69956b84fad1097c
- MD5 16a42e724dca6e615c32f946eff248b5
- SHA1 d7268760427213108e511abb9d178307b5748b9e
- SHA512 05e89e3d67cabd6d2af3c85c2d6ea2127000b9882422226c79cdde2f133834af26da5709fb65089a891fbb448ea0564e92b2dc72d05bde63cafb75bb6c9a2877
- SSDEEP 6144:n0bzD+JuwscXkH2KrzQ5t056pAje2l3Yd7CLRbq:nvJuwD0HQNWY7CL4
- TLSH
  T147446B15B7881B13F86E807BEA67C013E6729093931186CF037EE2895F57BC27E76526
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  cherax/System.ComponentModel.Primitives.dll
- Size 73KB
- SHA256 96789fbde342be57152e83b20e833bcc33f12cf30a7b5c9c0790990cf5886d48
- MD5 c735bd356e654447d20b566d06e9eb40
- SHA1 ba0a395ca66fbb3d9c2ffa7d2d4da5401847e64e
- SHA512 a5a5e334919d101b992ace420d59764e75317828b6a1b5b4c77d065e7718c88e2d83308a011c9dd7eea16dc64b0d1daebc20e5ee3647dcf92f5b566f1f04b576
- SSDEEP 768:PxI98FwPKQAtTKNI6T1mb1yF0YDC2oKQ15h498Q8a7QhDGE0nXBNEuLSoQuSmC:pITuP6kYFlC2oKQ6y8QRGvXBpL7SF
- TLSH
  T16F7339197BD80322FAAE863E91BB5851C276F5872723C8DF4901E5CE1F93BC26630579
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  cherax/System.Console.dll
- Size 153KB
- SHA256 ff3e09ec8ef8dc096bad8e1e9dcdcaf2367f63509179dcb3e5bc4c6de102b59b
- MD5 71138847373d2be68fd4da8e56552bef
- SHA1 fa9d9f20101f231c20e4d5cc5e05457ceebc2b2a
- SHA512 44a10b1babaff18db7a0cef316badcaeaa8e6f22aa0ecf1bb6a0570e19e4c1b697ccaa8c3cd3b315dbd072e4cad7041375c91c4aab922d67909833074ef6e202
- SSDEEP 3072:f9SMiIGbCwq+p14axXwbK80tmOaYMGr65pfSw:fQj9Rcclmzp
- TLSH
  T15BE36B26A7C00557EFAB86F990E32701C237E8A60B0293CB2545D6B82F47BC77F35595
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  cherax/System.Diagnostics.Process.dll
- Size 283KB
- SHA256 8ab493c640c85b298553d27db03244c4e76044c2a724fc896bd5085ce4046563
- MD5 6aef81c8bf5378baa131e86f5f340a11
- SHA1 0bb730b547bcd6025996d1a43d8717b8999d7044
- SHA512 f2e7c42990a746f0a8e3878a26a909ef1e58ad50917a928d0f946fd03a1ea0946ddbb7475496373451e53bcc25086501de8c8c79e91a0550528cbd8dbfe6e710
- SSDEEP 6144:W4vmEeveJQADJujgkju83yxs9b3NX1PkxEqCS7s03Y1KRRMB:W4etveJQAdSvju8CjWb03Y18qB
- TLSH
  T126548C1A738C5615FEAA9679C067C022D07DA1971707D7CB0364E6893FABBD79B30223
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  cherax/System.Linq.dll
- Size 525KB
- SHA256 eb5c46edcafdfbb7fa4d4c47d9510ad4bb22309a786e75153de634020d380d65
- MD5 d184d2b7b61a8aecb6d20f46778f96bd
- SHA1 eed8542f9ed41e4040c0ef6612adb18f302283a3
- SHA512 67bd73346d0e76053e803006b53db1ba267b536b0b761aeb4ce0d6ffea5f07495f7230a8dab0d6133c0508552e8ad7f1f9b528fc2bf5b6b5363d3fce6eb49c56
- SSDEEP 6144:lLvyrD97IjzrSLW5iIEobS5lEPsypTcenKskBvYvvyejaQO02Kullz8J1J4+PDxa:RarZ7Iu65iIET5mYIKsk8HQnUASxWF
- TLSH
  T1FBB44B1B93980701D40B827BD677405BC7A0DAD293D2D1CBE95CEA963EB7FD3667A020
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  cherax/System.Memory.dll
- Size 169KB
- SHA256 71590855c91416c5c0eb0b3eae631ac0869de17242435ca82e0b4e85ec5d0200
- MD5 c3aa1f663b6051e8ca14af1c00fee134
- SHA1 f143236c74a32dfe3208be3f679c36a5b42c9e97
- SHA512 323b91fafa6d846321513d5205dac5b9945bdfd6d4758c7820043b5d47410e7a1e384020f933c78fa8e827469b797a3fece3402e27a779eedb95e59d215a026d
- SSDEEP 3072:O0RPN4ab6HEuCKvSwOy6fM/vfovpPh/h/tmlIYrA6S1mUgMF6EpfSL:Ft+GKjtGPh/hwlU6EUka
- TLSH
  T145046C1AE7CC4727D82FD6BA85A68662C733204BB701A6CB45C4E5D80F63BD0BE77065
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  cherax/System.Private.CoreLib.dll
- Size 10.1MB
- SHA256 c173a4a6030b6f0b32416623cf798eab45abf2d7dd38565aefa2fe78965452ca
- MD5 762482bd3d55ca4e4e5296a64ecb7d0c
- SHA1 c95b20296bd8004422f655c2bd85eed436d410aa
- SHA512 bbd71857c3140bc0c5d34ea6a44c57bf73c47786229a83cf5aa098ec790719c4ab8457098fcb52b7c8570ae9b7ed5cfa39f535edddae8485b60b8a2b772e94e8
- SSDEEP 98304:pKd1eeIoZQsU+fRIwvUVvJS63bXYPrLAU4n/0v4/PyGvjb:UCoSsU+fRI/VvJSyXcOyGv3
- TLSH
  T14DB69E25E7D85B1BD01EC6BDC463C226C671E8A62313D6DB0018D7982F53BD6A27F263
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  cherax/System.Runtime.InteropServices.dll
- Size 50KB
- SHA256 4ce05de829e9ab9c8617492ef4b6cac595e5e5cef2815fca7a3551ae7f627c40
- MD5 e6c932b2f4620e2b55707e59cf87c05c
- SHA1 030004520a32aa29558db612f89d030305878fd9
- SHA512 4bb78029bae459dd33cba58fe5705f4d62990793f0b56cf878e24a593483102ec99303cbf137d5e5ce1bcec88a9d69ba1aa555da6f06d014c27a057c1fb355b1
- SSDEEP 1536:64oWJIP8z2r1GqhwF3FMjyPPkFRGvnpL7Sd:64oWikmgqhwNFMjyPm6npfSd
- TLSH
  T158336A226B989336DED64B3895B7AA914EF2F5C517238ACF9050C98D1E8BBCC0771335
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  cherax/System.Runtime.dll
- Size 41KB
- SHA256 82fa676a897296ac6265e63bb582d03bf7df54e59c83e6bcd08f6f99a3249ba9
- MD5 79d8b0685cf2d323c7cadbd276e435bd
- SHA1 ac74c0958d691b4009f8c8657639e4115a03729c
- SHA512 eeafe9cc578da300dbaa4190a866dfcd3d65ebfeaa0484f6595225d28cd713fab347f7b3f00af1f1ddd02adc83f83a2d03087a77ab374dfc905f1a88b3f74c6f
- SSDEEP 768:U0BV0jdpFKYl5f4bGRi2xVbcVT4pftdhDGE0nkpaNEuLSoQuSivU:UIedGYl5f4bGR3G0BtdRGvkwpL7SP
- TLSH
  T11B130660AE4B5273CE8E9772C8B3A08109F633CF64B7CDBA541E8546298F244D3B3759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  cherax/System.Text.Encoding.Extensions.dll
- Size 15KB
- SHA256 30ac13bd317d364b3fe4ad42bc45ed418fbe4acac9aa8f376a8a5fcea964bd54
- MD5 2e2fb3d8fb17d2b9f858cddd8cafa12f
- SHA1 4d4c81e30bb1c91dbce44c2a6950ed47bab7c938
- SHA512 fc1b6f58c966fccd78024edb2add0edd8d37dbdf919e2ec1e1396d0a431b52fc0bae1d80755ca06a441b0192341afc7047325858585eddeb9babd00d69606d47
- SSDEEP 384:7Iv0XhW6YJWa2mNDE2GdC0nWQgmHdpNEx0LSofousWu4BkCw8+:zUnhDGE0nSmHTNEuLSoQuS4f3+
- TLSH
  T114725C798F6496A2FE669F31D8EAC611ADB5B6C0AC42DD0B204805CD1F037A86F7073D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  cherax/System.Threading.Thread.dll
- Size 15KB
- SHA256 047dbd73dc9a8e7a4d7e516b323877d2a538fd525cab04d1d42fb5b2a7f474b3
- MD5 749294770b03a880e845c9b205369654
- SHA1 ec4b53c4c59fee60079e329d1c323652d99faec8
- SHA512 b02c8b58acd4c059abaeaabb674cfe1e67785612db8397952d4b73e65007d113a9794bf3f2400febc5e371ee61bde3299a8213e09cc0de4eb3163b70ba2bbb5c
- SSDEEP 384:Jz2EXZVPD2Wc+7WJ2mNDE2GdC0nWKYpNEx0LSofousWu4TOMk:NPFWhDGE0nmNEuLSoQuS2M
- TLSH
  T1BA725A654F6486E3FD22AF3094EA96566DB3B7C1E852C90B205984CD6F033686F70B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  cherax/System.Threading.dll
- Size 78KB
- SHA256 6e646460ac549ca63883e78e739590f4a400f8d2e00bd9e99b0f02102dbb812e
- MD5 08c6efbb7c22876c4b43dc64c6764a1e
- SHA1 d7845408d8e700df1a78421c3872dd451a1d9a41
- SHA512 6f2f37d0876263a68e957961a92a668fae0ee0d6fb1a9e6d64732c6fec80c8305630ab966fe5d1c8cac2cb96e38a179fe544afebac46fba53ad6a9edc4439b33
- SSDEEP 1536:2k5RkjKu+ydo98uGxdzJERH7AveyRGv6pL7SBd:2k5Rkdo9wxdzGKvey66pfSBd
- TLSH
  T167735A11B3E88666FAAF8BB9D9B22911C071F5DA1B13D3CF1058818D1E97FC19A71273
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  cherax/WinUpdateHelper.dll
- Size 84KB
- SHA256 a0c3de95e5bf84cb616fe1ee1791e96ff5753778b36201610e6730d025a6cb12
- MD5 907a534b96d71fa8b2309d33a45add48
- SHA1 a40846ad1ab464111161ca617912b66821635b20
- SHA512 31e384c9d6983947ce5bd7fddd1d2244a7c7d937a3728d79e57fdd3da40765a54c51cb998bc88f67f733068302d3dfeb0d8681aa392a3cb2850e92d9af10fe94
- SSDEEP 1536:hTVs0L9aNVhTRTewBeEyKsqFSSWWpT7DeMn0:hxaHRRTenD2zn0
- TLSH
  T15883124126FBB219F6B73B705EBFD5644A3A7CD5A87AC61D1284047F1EE1A008DA3732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  cherax/cherax.exe
- Size 170KB
- SHA256 1536a031601814633d7b3ff9ec7fcc2be613d5de6380fc7cc3cfb5392f6d9ab4
- MD5 b32e580185a128f9e8c65ce3e27a0692
- SHA1 336a5c6cda64d882e980e18f5c48a3d2dfa4f8a4
- SHA512 73ddb84c7d0f3496c775b432dfd24dff4b5ddf5730402067286e5d522a0f1a590eebad75d556c6435c3a26e2ad34212f6763decc423c027075e319556be1ea19
- SSDEEP 3072:Q5vnr5Tbx829UOeKnn2LFzZBp13u36wKp4zULCQodn0b6ipfS0:QBKjK2LFzZNfIUL9k02yF
- TLSH
  T1DA04080662AB31A8D1B7B23889BF8512F7763C15473186DF13904A7B2FE66D0AE77311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware credential_access defense_evasion discovery execution salatstealer persistence ransomware spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Drops file in Drivers directory
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral16
- Target
  cherax/clrjit.dll
- Size 1.4MB
- SHA256 cc9c853642c185b17d18f189c5e80928963bf485b0eeef7714e94339c5858e88
- MD5 c83270c072e51d37928ab8d4d42be464
- SHA1 4c0431bfb73e070180efa4d302e2cba57ba42ff5
- SHA512 37c5addc0583e1afd612fe375057f2ef07be4fc434b25b8eba79c3e10442e4ff1c0957b48cc0dc204f9eaaad13cd017ba6ee110b4f18d0e3ad752a32c8e7ed1b
- SSDEEP 24576:pLtbu58TIu2rlMBDr0PZYRhVj95f1L7Zr5/z/5ccUYXIBXzkTVsHgWolUZbGyqfs:pLtHAcX0PZuhVDh7ZN7/6YXIBjkBsHg2
- TLSH
  T110658C06A3E805F8D4BB9234C5934B1BDBB3B8161371CFDF57A04A56EF237922A1A315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  cherax/coreclr.dll
- Size 4.9MB
- SHA256 58d91f3c88293ac3b9761362c53af32520ca42f8be14244c0bd7a8e6d1c95564
- MD5 6f84d00e152bc64261ac7a0f6d4dc3f5
- SHA1 3f130aee6c3b5684d9d601c55b76f85a1576cc92
- SHA512 29f87baac29aeb092cab368b4c7903d6fdaf36c521efb960535f98c97124aacb4a39bd41304cbb382f1bd8d2ebd368aa144e5dd8d7106cfe264d8d5ae277fa13
- SSDEEP 49152:rRRteSC8CjfXq6EoB/SEsRfoSakEd9c6oWUqCJ0OTVRepih8IdCdTWOVxJYaHmnX:1RqXB/SEAKJspr8wKQXl
- TLSH
  T107369E56B2FD00A8D4BAC078CAD74917FAB178491738EBEF02644A552F27BE1A73D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  cherax/hostfxr.dll
- Size 369KB
- SHA256 e2486fc6dd58db5a55db18547459c0b160ba1b2e824193ae0dee0e9a0673d8d7
- MD5 155e4d45f02a4f7a2a228b44fa4791ef
- SHA1 14cb85f0d506b87bdad63dbec75f5e3206552592
- SHA512 25dfa7fdd5f3508ebe642c55330f81f7ad83d3d7bb20f4a3179e8d49805ce0dcb56f20820319a073a23d582b9b72e3ae2e646b92744d667717ee4d43bfdf6480
- SSDEEP 6144:CGr5uLf+w7dEtiODC3+Gr4iAOs2dEAh2gcmgrW09jcg:Zmf+qdEzD/iAOsVVH97
- TLSH
  T156844B16E2ED056CF1BBE23896B79905E6763C494770D6CF0390456A1F33BE09E79322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  cherax/hostpolicy.dll
- Size 385KB
- SHA256 def634e856fc681088c8833fc43962772d59b47384fe73d5fbfe689245974146
- MD5 12098df5d600e8d952fd43f07fac71e0
- SHA1 0a55613ecef2fdffcd55066400372f25430d8287
- SHA512 31ed39da9c9074f585d6586dd71137083375f2ebdedf91ae33d28374dc9dfc02b766b7456f4735f83c19ab01613441873c43ff15ec159383fe1c986d539d838b
- SSDEEP 6144:ZBGjtN9JhCdJeD1QL3sQy8XyV0l0gzPI37VPzBz3BU89GhOfBE/XodO:ZBGjtNlU/rsQy8XyxzNCOeXn
- TLSH
  T158844B16E2ED056CF1B7F2389AB79902E676384E477096CF03A0516A1F77BD09E79320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  cherax/mscorrc.dll
- Size 143KB
- SHA256 a231d44280d7044fda539b85288fbbadaba4830da421f0f28fd0444a05c2f107
- MD5 5f50c1cf588dd6f882ff5a329390fcd4
- SHA1 99ef8b69d4a299d87f373d24fe4523e4a81954dc
- SHA512 0279acda155406e371997dd7840a23f055097442b08dd666dc93739a1af7041fae7f889e782b119196b6409cd40d55e1556cd9aa2bfea676ab6ffbf1efa4a0a8
- SSDEEP 1536:7ODZms10iHvh7x8SKJlZ4vCCk7nw55IvZ4MgSZctpoEXX1RGvcpL7Sw:7ODZ/aSKlZ4ZGnwmUS4Sc16cpfSw
- TLSH
  T158E37791A7F95218F6F73B74ADB95AA00E7ABC96FCB9C21D1240805E5D71E408DB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21