salatstealer | 0f175fc70c236d5ed5af4c06e4415816bf1d9d4fda2a5b72ac1538fdb83d993a

General

Target
NB-Crack.rar
Size 4.8MB
Sample260903-vm97nax1fv
SHA256 0f175fc70c236d5ed5af4c06e4415816bf1d9d4fda2a5b72ac1538fdb83d993a
MD5 2e15b13f97861efa83ae6f4f17780f93
SHA1 0b399a86356cba9bfc5e2e8a24a93d3fbcb799e3
SHA512 1a29ff6c595562987ffb1d19e02400251cb280323fa8a17552fb5389504d02b24a961cdf855d4b11c88fedc71860b43e46ade84bfa42ec95f8642219aeb2052f
SSDEEP 98304:3OZO4DJHJ8Oq45TDGNbGxRDfgmXPDFP0SoXqXifEd2NHnt6bJ3s:3OZjVpVD2GxrPh0QXifpdntcJc
TLSH
T1273633097D245AF2273C4D49BB31EC6B34A97F9AD09237198914F36D63FA8A1B3491F0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  NB-Crack/NB-Crack.exe
- Size 4.1MB
- SHA256 59f53ac41fc744e001bd9fe56bbd1bbec041460c7c0dae30b776472f116a341c
- MD5 1544922eaa7042676d3a16ee3b9e95d1
- SHA1 cb03385df41e4e238c4015399e2b6272b98e4df2
- SHA512 f8bd8f18ca4a17dd5765bb98fa74b6d48aeedd79c71abbea00a39c075e4a04b3fbe412d569c78e50c6fd7d065857d5789212fb98e6e212faeec73b817ee862f3
- SSDEEP 98304:w3G4MhkqYEoY0E03l3knvyscxfDIV/5GdfsWuwO9JOjcsltC:w3G4MhknE0mnvyzccdfsWuwcg47
- TLSH
  T18616239DE7BC04ADE6EAAA388CE25C1ED6BD3C150511878E327517493F27F908E56332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution salatstealer persistence stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  NB-Crack/updater.bat
- Size 2KB
- SHA256 7ec1b6d56ba8420b3577f9eac2352f522d6571b225c549dba61c7ee7e1b1eb71
- MD5 4ecbdde4b6e6a4e463b3440e93ea49f0
- SHA1 9e2343e43bff569578c780d219cbdd08eabc21e4
- SHA512 4920a4437c1af991ba5a430e5d10d8fa990bede652bc7aa1b78188b32bb723ab1aa3ded0daf0bff44fe0f768e33cc36c7a167fad7a69d75a97609adf6bdae066
- TLSH
  T11F51B16B7CC2B760939C24A48C75307D6EE35CC7EE5759C6A94E202D06393A332FD18A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

defense_evasion execution
behavioral3 behavioral4
- Target
  NB-Crack/updates/Updater.lnk
- Size 2KB
- SHA256 3146e5203b42e508444fb51472ef05aea14bed2d8b37f5d0fbcae29cb81ae91f
- MD5 c7348b277bf91e94dfc93f4ed9923941
- SHA1 861133e749b5085a30d50049e2dd7570817c872b
- SHA512 b9abf468d7b0982a4908bc5dcdd6f2ebaa05ef9fe015f3fe5e46be016a63e73689af9ead4321c6e6bab36e5c3d6c78fb3240c2e6376cf6b158bd4c3498719bfb
- TLSH
  T18741CA161BE22B60F3B34671697127B40B3BBC46F6298B0EA09602CC49633615C98F7A
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6