Overview

overview

10

Static

static

3

cherax/Mic...es.dll

windows10-2004-x64

1

cherax/Mic...es.dll

windows11-ltsc_2024-x64

1

cherax/Sys...ic.dll

windows10-2004-x64

1

cherax/Sys...ic.dll

windows11-ltsc_2024-x64

1

cherax/Sys...ns.dll

windows10-2004-x64

1

cherax/Sys...ns.dll

windows11-ltsc_2024-x64

1

cherax/Sys...es.dll

windows10-2004-x64

1

cherax/Sys...es.dll

windows11-ltsc_2024-x64

1

cherax/Sys...le.dll

windows10-2004-x64

1

cherax/Sys...le.dll

windows11-ltsc_2024-x64

1

cherax/Sys...ss.dll

windows10-2004-x64

1

cherax/Sys...ss.dll

windows11-ltsc_2024-x64

1

cherax/Sys...nq.dll

windows10-2004-x64

1

cherax/Sys...nq.dll

windows11-ltsc_2024-x64

1

cherax/Sys...ry.dll

windows10-2004-x64

1

cherax/Sys...ry.dll

windows11-ltsc_2024-x64

1

cherax/Sys...ib.dll

windows10-2004-x64

1

cherax/Sys...ib.dll

windows11-ltsc_2024-x64

1

cherax/Sys...es.dll

windows10-2004-x64

1

cherax/Sys...es.dll

windows11-ltsc_2024-x64

1

cherax/Sys...me.dll

windows10-2004-x64

1

cherax/Sys...me.dll

windows11-ltsc_2024-x64

1

cherax/Sys...ns.dll

windows10-2004-x64

1

cherax/Sys...ns.dll

windows11-ltsc_2024-x64

1

cherax/Sys...ad.dll

windows10-2004-x64

1

cherax/Sys...ad.dll

windows11-ltsc_2024-x64

1

cherax/Sys...ng.dll

windows10-2004-x64

1

cherax/Sys...ng.dll

windows11-ltsc_2024-x64

1

cherax/Win...er.exe

windows10-2004-x64

1

cherax/Win...er.exe

windows11-ltsc_2024-x64

1

cherax/cherax.exe

windows10-2004-x64

8

cherax/cherax.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    cherax.zip
  • Size 11.0MB
  • Sample260821-ymc4psdb45
  • SHA256 632097437cb415d6f8860ef1fafafa4b25301185c92ab7ac2962baa605a2ebda
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
salatstealercredential_accessdefense_evasiondiscoveryexecutionpersistencespywarestealertrojanupx

Malware Config

Targets

    • Target
      cherax/Microsoft.Win32.Primitives.dll
    • Size 25KB
    • SHA256 191ce24960a2d1b22d6333f85bffe1c7050fe920c558cd39e51e48174e86b391
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      cherax/System.Collections.NonGeneric.dll
    • Size 98KB
    • SHA256 702eba63368c2cd0c12321763913e8661805ff3506d49fc4499c38da93c9cf90
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      cherax/System.Collections.dll
    • Size 258KB
    • SHA256 05b1364b1f6e37f089e46db060e0708a5d2cbd6da2d795cf69956b84fad1097c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      cherax/System.ComponentModel.Primitives.dll
    • Size 73KB
    • SHA256 96789fbde342be57152e83b20e833bcc33f12cf30a7b5c9c0790990cf5886d48
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      cherax/System.Console.dll
    • Size 153KB
    • SHA256 ff3e09ec8ef8dc096bad8e1e9dcdcaf2367f63509179dcb3e5bc4c6de102b59b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      cherax/System.Diagnostics.Process.dll
    • Size 283KB
    • SHA256 8ab493c640c85b298553d27db03244c4e76044c2a724fc896bd5085ce4046563
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      cherax/System.Linq.dll
    • Size 525KB
    • SHA256 eb5c46edcafdfbb7fa4d4c47d9510ad4bb22309a786e75153de634020d380d65
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      cherax/System.Memory.dll
    • Size 169KB
    • SHA256 71590855c91416c5c0eb0b3eae631ac0869de17242435ca82e0b4e85ec5d0200
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      cherax/System.Private.CoreLib.dll
    • Size 10.1MB
    • SHA256 c173a4a6030b6f0b32416623cf798eab45abf2d7dd38565aefa2fe78965452ca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      cherax/System.Runtime.InteropServices.dll
    • Size 50KB
    • SHA256 4ce05de829e9ab9c8617492ef4b6cac595e5e5cef2815fca7a3551ae7f627c40
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      cherax/System.Runtime.dll
    • Size 41KB
    • SHA256 82fa676a897296ac6265e63bb582d03bf7df54e59c83e6bcd08f6f99a3249ba9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      cherax/System.Text.Encoding.Extensions.dll
    • Size 15KB
    • SHA256 30ac13bd317d364b3fe4ad42bc45ed418fbe4acac9aa8f376a8a5fcea964bd54
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      cherax/System.Threading.Thread.dll
    • Size 15KB
    • SHA256 047dbd73dc9a8e7a4d7e516b323877d2a538fd525cab04d1d42fb5b2a7f474b3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      cherax/System.Threading.dll
    • Size 78KB
    • SHA256 6e646460ac549ca63883e78e739590f4a400f8d2e00bd9e99b0f02102dbb812e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      cherax/WinUpdateHelper.dll
    • Size 84KB
    • SHA256 a0c3de95e5bf84cb616fe1ee1791e96ff5753778b36201610e6730d025a6cb12
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      cherax/cherax.exe
    • Size 170KB
    • SHA256 1536a031601814633d7b3ff9ec7fcc2be613d5de6380fc7cc3cfb5392f6d9ab4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryexecutioncredential_accessdefense_evasionsalatstealerpersistencespywarestealertrojanupx

    • Detect SalatStealer payload

    • Family: salatstealer

      SalatStealer is a stealer that takes sceenshot written in Golang.

      stealersalatstealer

    • UAC bypass

      defense_evasiontrojan

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Drops file in Drivers directory

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Downloads MZ/PE file

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

Windows Command Shell

1
T1059.003

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

discoveryexecution
Score
8/10

behavioral32

credential_accessdefense_evasiondiscoveryexecutionsalatstealerpersistencespywarestealertrojanupx
Score
10/10