salatstealer | 46afae5a6092d7b30bb7f5984bb5b0f2b18e46b660cb6ff46853848895b6aa4b

Sharing

Copy URL Twitter E-mail

General

Target
46afae5a6092d7b30bb7f5984bb5b0f2b18e46b660cb6ff46853848895b6aa4b
Size 15.0MB
Sample260908-sa1rcasfpb
SHA256 46afae5a6092d7b30bb7f5984bb5b0f2b18e46b660cb6ff46853848895b6aa4b
MD5 9d08d59593f32da2131c372e3a107f16
SHA1 02667fbe06be28a7a9c1356da7567e83928ddc8d
SHA512 b463936d9594f1fcf9b120a1ca47dbe127f56cff91e7e31aa5f309de9ef2e2c59d0ea713c77a55964c60b9e9a275ed03f02ebb4550f35ccc4eae6fae75790aae
SSDEEP 393216:RptM9vHAGptM9vHAHptM9vHASRc1ZwXjXas:5M1TM1aM1ywTj
TLSH
T1E7F6332BF1AF4A73E7E9A871560FCA7454B1AFE41970D38AE4D7EB9E0841BD0C241325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  zapret-discord-youtube-1.10.2/bin/.wd/wdvcache.exe
- Size 3.4MB
- SHA256 273322d356cf81182711d7995b92a5b6d0e70aee45a63a351efe8113cba6f87c
- MD5 0b7a546d1a6aab11126d57153582d629
- SHA1 3ca65b3fdd48a978362b898a38f3e3cbdaf98c0b
- SHA512 4d93156feab552852320454e55d420cf2eb12723ba28ee36020f587f8c12e33c8bc23d6e50ccd5ec640d7f6281e2b985debbc5f068db281f024f1ef660d44a8f
- SSDEEP 98304:niJ2oaNEfaVbzxGvBkBWZGVLTfh7wpEES4O:iJiafuIO7rhWEES4
- TLSH
  T11BF5335BF5AB47B3F7D9A831560FC66458B09FE40A20D38AD4DBAA9F0886BD0C241375
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery salatstealer persistence stealer upx credential_access defense_evasion spyware trojan
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  zapret-discord-youtube-1.10.2/bin/.wd/webrat.exe
- Size 3.4MB
- SHA256 273322d356cf81182711d7995b92a5b6d0e70aee45a63a351efe8113cba6f87c
- MD5 0b7a546d1a6aab11126d57153582d629
- SHA1 3ca65b3fdd48a978362b898a38f3e3cbdaf98c0b
- SHA512 4d93156feab552852320454e55d420cf2eb12723ba28ee36020f587f8c12e33c8bc23d6e50ccd5ec640d7f6281e2b985debbc5f068db281f024f1ef660d44a8f
- SSDEEP 98304:niJ2oaNEfaVbzxGvBkBWZGVLTfh7wpEES4O:iJiafuIO7rhWEES4
- TLSH
  T11BF5335BF5AB47B3F7D9A831560FC66458B09FE40A20D38AD4DBAA9F0886BD0C241375
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery salatstealer spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  zapret-discord-youtube-1.10.2/bin/.wd/zapret.exe
- Size 3.4MB
- SHA256 273322d356cf81182711d7995b92a5b6d0e70aee45a63a351efe8113cba6f87c
- MD5 0b7a546d1a6aab11126d57153582d629
- SHA1 3ca65b3fdd48a978362b898a38f3e3cbdaf98c0b
- SHA512 4d93156feab552852320454e55d420cf2eb12723ba28ee36020f587f8c12e33c8bc23d6e50ccd5ec640d7f6281e2b985debbc5f068db281f024f1ef660d44a8f
- SSDEEP 98304:niJ2oaNEfaVbzxGvBkBWZGVLTfh7wpEES4O:iJiafuIO7rhWEES4
- TLSH
  T11BF5335BF5AB47B3F7D9A831560FC66458B09FE40A20D38AD4DBAA9F0886BD0C241375
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery salatstealer spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  zapret-discord-youtube-1.10.2/bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  zapret-discord-youtube-1.10.2/bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  zapret-discord-youtube-1.10.2/bin/admin_guard.cmd
- Size 278B
- SHA256 f052bc89afc47ae53e922859c580e685c07145d7f6f56d84f380a9d97fcb126e
- MD5 e9a9c63502ba81e7723cd106f464999b
- SHA1 4768deb0c50bd06c2f41e6f8635f76d27da23763
- SHA512 7ffc4f76b32ef6778d0910664fa7d1394634be6ddf729b0cef76a6cb22d7c92177a469cf65a428588d8101aa9e7b59d206413489519071f0a2995619186933f9
- TLSH
  T1DFD0EB0602885A7B8AFECB0042F94AA3DACC43CF122632C230F4D211F8CA441C6C0E81
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral11
- Target
  zapret-discord-youtube-1.10.2/bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  zapret-discord-youtube-1.10.2/bin/defender_guard.cmd
- Size 1KB
- SHA256 197ce86f9c1067a7ce07a50cb582befb861b4e187bc9818b88175651e9f91932
- MD5 93543e0e49904c2c3cb729b203ea475e
- SHA1 7e561d30fb2568d06ad2249e77850593ad9764d4
- SHA512 0434e8e5c5f57f6180d15fcd5ba8371e1399682d815aa433d1499e33349b74aedecf2a00254ebf428a2c3d17eaba5fcaf500c2d63cb9264eb9ec8f5a66a77bbd
- TLSH
  T16731464A921016FDC3F9064415C353A8F78B4099E67DD7C11897822BE53944B8EFDF2A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral14 behavioral15
- Target
  zapret-discord-youtube-1.10.2/bin/extract_guard.cmd
- Size 363B
- SHA256 fb4030fdab4f882d1600036287381826411386dac9d4a126fca074cda0c13dbf
- MD5 74fd49efb7855253f318c689d4819dd6
- SHA1 e1a1785761043b47adac84df5af2012c1fb1dc25
- SHA512 e447d04c358c232576327796238f5682432efd2523fc7c99093bdb16c009a733ab51c350ff66fd34cc3caeb6e541f1e9308e3f4f82d1b3bd9076f36d862834a8
- TLSH
  T19FE068A9B2637C26202816D02F71205C6CC302F757CAADC1A8F3151834AA2B877860B0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  zapret-discord-youtube-1.10.2/bin/gbzap_lists.cmd
- Size 1KB
- SHA256 9821d5236f7025adca57195a1d5069554e1980f3e52c590a27bbdaa092a5a883
- MD5 47de6b70ea0a15d01d467246f250c6ea
- SHA1 b68d3ec11ca13f05c275f9e98e88149f06fb26eb
- SHA512 e76e873be5169881636cd113160bb17e2b1eb7e1bbf0e3df05879e68d37c3d92b9506da3a28de55e13453241b1539983f72ce0b03bd5e3f8bfe79975471257bb
- TLSH
  T1612108F8C1081480DCF4B1BFF10A80A5F67A68D35C40D96D3D6199ABA66FB47CE9B46C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  zapret-discord-youtube-1.10.2/bin/gbzap_seed.cmd
- Size 185B
- SHA256 b7fa470a7793972c8517680f209dc74231980634851ee51e9ee0acd0203f2617
- MD5 d4482d0a5a5fc495aa65068e958c0713
- SHA1 56d6cbe9ab7549378f215ce22cce3b6e8d974597
- SHA512 de0948c1948418b2e9ae1f5bfb58e7b4aa00104029f45a489f38e5212b7ce924e8dfd4064ff77c29aafc4be4ecfd7a6f5b5d1b7f07224b40f17f70b4fbf07dcf
- TLSH
  T10AC0126F04401E59D81C1E8822E0083266D513CBD50B2DE011A2880BC04557081DAED9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  zapret-discord-youtube-1.10.2/bin/payload_fail.cmd
- Size 578B
- SHA256 2fbf2b977310f1b4179396e04b25b731995856f795492394ae19364662449bae
- MD5 6986af1ea19d757c6961f543e3dcca08
- SHA1 b5f8926b4b6e3511215b4feb43e0dbb3a774a2a8
- SHA512 f6514f1901a898f41fa4c25a694bb115936130abcdaf115cc85bc0ebdd8bec5200de8dc409007c6d3f4c1c60f8893d38c578e9ab4e52b080a9853bb373490c86
- TLSH
  T1C1F028B216A0B84F5000D54ECE199A4A3CDB00FF2CDA668315B16C7D34E9184E57E91D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  zapret-discord-youtube-1.10.2/bin/payload_fire.cmd
- Size 379B
- SHA256 d760ebd00d5737f3075a72284047ec42a2ce96a219e74fde557ae8b0493e157a
- MD5 0c2110bd9b0c957f85a54d196e7b0ce8
- SHA1 0b9b4538f9188a47ab33724938f6cf0f3f63a838
- SHA512 69d1d24a80a1dafea56b5f9bd9ec1696ef0bb5cfc252031b9f9be616d5b0d399556b477ce049ce08e113ce32d81d7a6ef59a4a4a52d47ec77e0ac21472724731
- TLSH
  T1F3E06D30A40402215AF1267D06A328D7BE86C36AC32C40C0B0AE697AC9BED4F60DE2E5
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery execution salatstealer stealer upx credential_access defense_evasion spyware trojan
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral24 behavioral25
- Target
  zapret-discord-youtube-1.10.2/bin/payload_kick.cmd
- Size 553B
- SHA256 895e1319c45dbe2c440116d3050e72abddc807d99e6fa7d9313507150f72514d
- MD5 15d3975a7d66e59613060a91ea996e01
- SHA1 22a7d7038dd57c5c6737abea1b523dd4aea92d8a
- SHA512 bcecc108a1e38ff79a81adb3fda95760c9e5a4c05a7f4a7c94c67488ae9638db3d169e6caef338d05f16068c184a1dd0996b6ffcccaa34d77044db5199868070
- TLSH
  T17FF0BB2FD9004C257C6325D183E91562D9CFE35B4F4877C070E0945DA46F31885FC9EA
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral26 behavioral27
- Target
  zapret-discord-youtube-1.10.2/bin/payload_run.cmd
- Size 737B
- SHA256 84fea0e7e3c3b77e8efe70ac9a39a9653c2954701ef782890dfc75c164c4e09c
- MD5 cf81640910bf9ccca163fbbf74e7769d
- SHA1 5cf04c4aef65ef5efb314dca01efa9276b5c0709
- SHA512 7fbf0e22387866a67eda2d42b52493e3c31e2eecdd9ed56873626504e9cda0fefe6b80cafb860a680de889508a2e1b431bd6aab45e7d7d1b37992ff86c4578dd
- TLSH
  T15E01D82DE12158D4C8F19AF406CA05D65A67BBB3877C87C3706584CDE46720E81B9DCD
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral28 behavioral29
- Target
  zapret-discord-youtube-1.10.2/bin/wd_cache.ps1
- Size 2KB
- SHA256 f00648076fccb5c0282757ae461d8374b71b2eaf717dd630e4ba02cb029d9e14
- MD5 6aa03feefd69dcc9b8045267033fbb88
- SHA1 f66d1c6e8f6b2429ee83e7b59056205784ac06de
- SHA512 8ef2f632da933070adff21512148b6e092a6bc744ac248b33754f47bc75f5acb0b865e235308b70bd91517ec1c82ccd8ecb48a28b37321e9522203123d3e501d
- TLSH
  T19F513025F21AC59A4AC5613B1488C8989A39183F404C7E0C369FD748FA75B5C87FCBF4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  zapret-discord-youtube-1.10.2/bin/windivert_drv.cmd
- Size 1KB
- SHA256 9666f4fd350b4a9629618e61b02bdca4e63ecbe560b1d5482c427b0779470b16
- MD5 dd840282cfb304893dfd89cf4160c927
- SHA1 37c55d1b9548ee0e7981152d90ad0d465a0f163f
- SHA512 d928270011cd4b367d43f09130e92d9070062b7818b8944cafe5c5db835016e340a976eca6d3ab73aa809aceb0ba54fe879ef83164e8e4be92826f5bdde6caea
- TLSH
  T17931245617302FF281FA06909AD706D8FA87C15DD0AAA7C16455C206E81650F8FBEE39
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral32