salatstealer | 1536a031601814633d7b3ff9ec7fcc2be613d5de6380fc7cc3cfb5392f6d9ab4

General

Target
cherax (1).exe
Size 170KB
Sample260822-qnp6nahj2v
SHA256 1536a031601814633d7b3ff9ec7fcc2be613d5de6380fc7cc3cfb5392f6d9ab4
MD5 b32e580185a128f9e8c65ce3e27a0692
SHA1 336a5c6cda64d882e980e18f5c48a3d2dfa4f8a4
SHA512 73ddb84c7d0f3496c775b432dfd24dff4b5ddf5730402067286e5d522a0f1a590eebad75d556c6435c3a26e2ad34212f6763decc423c027075e319556be1ea19
SSDEEP 3072:Q5vnr5Tbx829UOeKnn2LFzZBp13u36wKp4zULCQodn0b6ipfS0:QBKjK2LFzZNfIUL9k02yF
TLSH
T1DA04080662AB31A8D1B7B23889BF8512F7763C15473186DF13904A7B2FE66D0AE77311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  cherax (1).exe
- Size 170KB
- SHA256 1536a031601814633d7b3ff9ec7fcc2be613d5de6380fc7cc3cfb5392f6d9ab4
- MD5 b32e580185a128f9e8c65ce3e27a0692
- SHA1 336a5c6cda64d882e980e18f5c48a3d2dfa4f8a4
- SHA512 73ddb84c7d0f3496c775b432dfd24dff4b5ddf5730402067286e5d522a0f1a590eebad75d556c6435c3a26e2ad34212f6763decc423c027075e319556be1ea19
- SSDEEP 3072:Q5vnr5Tbx829UOeKnn2LFzZBp13u36wKp4zULCQodn0b6ipfS0:QBKjK2LFzZNfIUL9k02yF
- TLSH
  T1DA04080662AB31A8D1B7B23889BF8512F7763C15473186DF13904A7B2FE66D0AE77311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware bootkit credential_access defense_evasion discovery execution salatstealer persistence privilege_escalation ransomware spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Drops file in Drivers directory
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Uses Session Manager for persistence
  Creates Session Manager registry key to run executable early in system boot.
  persistence
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Windows security modification
  defense_evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Downloads MZ/PE file
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1