salatstealer | 9bc17d4795a0ded195115e7bc711f83fc3f39f574eba1b118305ce05978bb80f

Sharing

Copy URL Twitter E-mail

General

Target
Crystal Snoser.zip
Size 16.3MB
Sample260825-t8htvsswe1
SHA256 9bc17d4795a0ded195115e7bc711f83fc3f39f574eba1b118305ce05978bb80f
MD5 042fa5d9d85181acab52664f78fa7ceb
SHA1 19bb28b2eca636cc114e1caab23fa5184d70951f
SHA512 29022b78198b014f288ae1f1b11298674a9395fb343e4e763dfeb9b9551d72b48c7cec68b72df45b82bcfaefc8407365782d24e86143fce4dd98cc4fcd418332
SSDEEP 393216:7x2YRb4bvo7jEKZwiEHndNCfUsxquOFBfn8PhxAPQVqGCEsRI:7x2Yuvo7QZjHDCHCv8PhxUQltv
TLSH
T1CE073341D444BFFC62B944084255881B170F8A849DD88F13D6EFABDF761823AC6EF5BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Crystal Snoser/Crystal Snoser.exe
- Size 15.0MB
- SHA256 d6ba9737fdb1c0f6a70156e92bc6b5e2398dd4400a43e152940c9f2584ce6854
- MD5 e6c8cb0c3f9611532112129d8c84548a
- SHA1 f852fad312ec59fcb89d29388fd284bb3adae59d
- SHA512 b2c8b53072ac4dd1b7c83ac7ee933f793163b1245c291f47105f1548d38d23bc9fe53a57b54b07a8571d8c8b9abeb6d43fcb6a368bb66abcd1b379223691f2aa
- SSDEEP 393216:+X/OqkblIrbyRTUajraGoZ1HZ+TE6HlkgHpqecOxnZshEhFbmSyvZuS:+X/OPlIGZ2Z14LbgL0shEhZmSyvoS
- TLSH
  T10FF6335CB6A229FED12AA1B65A7C0705F2E0CF231F9B4DCB145056181CFE4A3D91B62F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution salatstealer pyinstaller stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  Crystal Snoser/SNOS_CFG.xml
- Size 96KB
- SHA256 b2369a301f0f3a660a9b6193daa392d8974e2e54e1664ef31d82f06ea7993835
- MD5 fbd867e3fa92d8faf358aa793f67c76b
- SHA1 17b4cf811677c4edca885041d953cd12613ee8cd
- SHA512 6241d1a7eeda140044ffe3ca2d5a59876953d8684f6e182818e0d0d057141c6153b30b1f4d2e3ab2356a40d2ad112a76d682c4233f0990704c0500ebf7a6ceb8
- SSDEEP 1536:hgr8c3TdAQphiGD1rARLMkFofLGuAm1rg:kCQwx
- TLSH
  T141A357192E14EC1F0BD4E6BFFDD6620F8D6984A7E629F1A4306C73871A5BD4006BAC53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral2
- Target
  Crystal Snoser/engine_929.lib
- Size 68KB
- SHA256 db7a9d272118cf9be1f323e43f15efe0b02017a5304571aff81b05ee450cf01d
- MD5 f68b76acd7e1f9ce645c951f19e8bb77
- SHA1 e815b8b781d39b177b9b92b143504f417e8af345
- SHA512 12f4904b56d259e9437db8f6227f3cc835da2a1463a5fd2695d02f05365047bb05272933bc33e141c641c9278e024350c9b322acb5aa16044bc8ac812218e910
- SSDEEP 768:Ef/QMMJGXhHb7sdP3p4SD5H2I34Pq+M6xwz8QGTjwvRGXwH49AOtHPoKDvIkA/aC:EfHi87wHIPFMmsDGvwJG9AOFAyxg
- TLSH
  T19A6349416FA8817B34510BFFB66670812EBEF291745F38C67231078F9785D789E72A20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  Crystal Snoser/module.res
- Size 307KB
- SHA256 6b9e085fd2c0201834403d0e40ddef81ebd1c8131e754ee928e381e90b65d0fb
- MD5 d688408fea2ad94bbcbcdbe3cdce219d
- SHA1 1be73a7b4098b59288b7bede3881189f492a4cb3
- SHA512 1cc9ac48f24e17cdedd4fd010ede703f167bc5204cb4a3d25514826cf195a0e33e133596a5dfbb4e62810fa71412bbb5ade9801270bbabb4ad7c670dd3aacbd7
- SSDEEP 6144:5n04PZnDI1SQOssU1GGhT+EdoloP6+QWpn:5TJDyAG1hqEi41nx
- TLSH
  T160644A046FB4816B38524AFFB56670813ABEF2D1745F39C27235039F5789E789E72A20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  Crystal Snoser/snos_693.pak
- Size 326KB
- SHA256 d714e592d305113651c63f2ccc5957ec707a0e2c9d4f54d5aa7df512943ed130
- MD5 2c0cb662e10c4ab3318de8916a4e137e
- SHA1 afca1c983b6f97a6cb3c5af9a21ad431921413db
- SHA512 2db7eef62655135aea450e23f4ae3666a38b1848151ca8d0d3c1ee6f4fdff9e0f63f8ab177d8cf29d33ec8672920ce747793731f98c6265b857e9bafb6664fea
- SSDEEP 6144:p1llbtUn92dKfEBWF8njc3ACjwBn7rnPBmpYc:p1lDI9UPRnw87rPBmpYc
- TLSH
  T1EE645B045FB8816B38624AFFB56A70812ABEF2D1745F38C67235039F5785D78CE72A60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  Crystal Snoser/snos_telegram_snoser.log
- Size 307KB
- SHA256 dacad9a83523eedc06c2969565795b03da2017cb4c2d9912fe8f53e1f42f63b0
- MD5 3b239f3a91eea2ece56492d2ed624efc
- SHA1 f6df04419d11ed5e3206330ad680ec785e467e1b
- SHA512 a911c52e323dc71b2d4cc53b5c51ab86ba1adfc0dcf1bc0dbfd11346c4b14a953ea1429ee472ad8bd6db3dff68b86f5565294c9b37225576b548774d2714aa5e
- SSDEEP 3072:+Dei4rzNObgF/nud4SP6tZYF5Lvny49Hs9mZ6wuD/3n2LsBGa2pAUq8rh2P:s4r7e6EF5Tzxn6wmm4BCxqQhg
- TLSH
  T16F644A046FB4817B35524AFFB56674812ABEF2D1B45F38C27235038FA785D789E72A20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  Crystal Snoser/snoser_snos_telegram.config
- Size 479KB
- SHA256 8fd12802bac2c4a9b52a04a9eb5578f994daa3f17d716635c5e28175912a6960
- MD5 ee81a30cdb3e7807f5b0902248cb644e
- SHA1 457d12625f5a3baff8df304b0f7c3f5e3420fe13
- SHA512 63b5ef006dc1776a8bd6eddcca912fe2e63186e4730a9ce41f6ee3e5d43149c941fd7e292d1d4f0beafd3af59c4c30ab13ac4e57a23d14bf16a4157420c6827b
- SSDEEP 3072:9u1Ky1GruORV/zxFE/ViGpPcT+yWROL0JKvxvPNyl0EN0OFNn2wT:0f1O7WvPcT+yWgLCKvxnNySLOFjT
- TLSH
  T1DFA463041FA45D3B2074A77FE7B520CB56B1E7CA302B7DA2B12802BF5E61E584B67934
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  Crystal Snoser/storage_timeout.bin
- Size 477KB
- SHA256 30bf0661bb70f7d1f0b1280c5a37825a892b4e855024849124e37b389fdb4f52
- MD5 14a426ccce134f3571ff5a607e15ae18
- SHA1 0219e577540a4376fcb2aac5347bd86821cdcc08
- SHA512 a745a589482a1af4b7f01a95220d8e7e2c85aa13947dbc7ad77d87d47982b9b3e481e00b7cbaf34b1a007bb34b17eb31d60f13eab7d340ce0ecdc324b6123870
- SSDEEP 6144:OWV1VZuRW2HQOGHbgJuj83jKMSUu3d8uWXjjmtWAjqMmRh8fwwdySJbqgx:5QkLEuyKautUzjI8V0ySbx
- TLSH
  T1D5A44A046FB4816B34524AFFB56A74812A7EF2D1745F38C27235038F6799E78DE72A20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  Crystal Snoser/telegram_buyer.config
- Size 401KB
- SHA256 a55eab12b48614dda1ec4f7936aed7e71914fdc9f2a948b45b6d48311fc92aa3
- MD5 eb9fc46df236570446823e9b00bdf3ca
- SHA1 eba2239e89bc48ff662e72bd5f2d6a2c4ef9d497
- SHA512 7b6452e01807a873c5d6e0153bcff799255b751ab37c7ee308d379e441deffd85e244d4628eee41a17813c816d634b55b21de4baa507d6971bb94a4bb173c4a6
- SSDEEP 3072:2RCn0gKEMtl6b9CxeOZb5J3CLpu5vSXLktkFQU:J0gJMuhubDIu5vSbH
- TLSH
  T1629463041FA45D3B2074A7BFE7B624CA56B1E7CB302B7D91B12802BF5E51E488B67934
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  Crystal Snoser/worker_mode.dll
- Size 347KB
- SHA256 f8e2d92c88e46442d5f7edb94e6f03b7a16630620916b32456dcf0b9bb27ac6c
- MD5 47dd4813bad475bee29ab2722813a81f
- SHA1 16f816cd1c072e5aa64d2dbb31c3a6e0a8ece614
- SHA512 0d6e9c358e4e82b9b85413661d5ec8668fff59dd3a97af7c484713e7caaf196309fec0ea256250ea266b0c4bfdc29087658a1da81f9a9acdef5fdd490f5bbd64
- SSDEEP 6144:bxMlstr2s6z52V8PDs6WBxSOohBxpM4lA1yA:lisN2Nzw8PDA8Oq3MYA1T
- TLSH
  T183745B046FB4816B38524BFFB26674812ABEF2D1745F38C27235078F5785E789E72A60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10