salatstealer | c6d32800826929321b115f027b2a998ab11e6aaa9b250a81e5383fd87fee4ccc

General

Target
uxcryptorbypidori(1).zip
Size 10.8MB
Sample260908-wbahbswcld
SHA256 c6d32800826929321b115f027b2a998ab11e6aaa9b250a81e5383fd87fee4ccc
MD5 3c4f46ea401918be5da49bd5db744d67
SHA1 ae03540c017d34081a61ee1fc73c39e298c60c73
SHA512 a73b47b62132880cb44bab1b207298eb3627c6781d1c1776f7c72adf886f56933ce0bd8d61f2ac6bd3ed251d91c8b6cc88bc7dafbbc2e74314e8811785e16cfd
SSDEEP 196608:8OVrfaWhZu+WSCbF6bCkji+lElIfZTd6XgLKJvhaAwK59CnynG6iL3w20:fVr3hZu0el6DL06TyG6iT0
TLSH
T169B633E9793A0D2375A009AAA1012F20C5FD2BABE24E44C65B03F75675B1BF3DDD0386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  uxcryptorbypidori(1).zip
- Size 10.8MB
- SHA256 c6d32800826929321b115f027b2a998ab11e6aaa9b250a81e5383fd87fee4ccc
- MD5 3c4f46ea401918be5da49bd5db744d67
- SHA1 ae03540c017d34081a61ee1fc73c39e298c60c73
- SHA512 a73b47b62132880cb44bab1b207298eb3627c6781d1c1776f7c72adf886f56933ce0bd8d61f2ac6bd3ed251d91c8b6cc88bc7dafbbc2e74314e8811785e16cfd
- SSDEEP 196608:8OVrfaWhZu+WSCbF6bCkji+lElIfZTd6XgLKJvhaAwK59CnynG6iL3w20:fVr3hZu0el6DL06TyG6iT0
- TLSH
  T169B633E9793A0D2375A009AAA1012F20C5FD2BABE24E44C65B03F75675B1BF3DDD0386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  uxcryptorbypidori/DONTOPENTHIS!/DONTOPEN!--This_Is_Stub.exe
- Size 215KB
- SHA256 19b6c1905f4435815f6d79b7eb0aee50ccc6d4ccde4dca9b973e3589e15fc00d
- MD5 f92e29949ab567932169f73da6291cca
- SHA1 1b44771253389ab095ef5a356245e743d627a0c6
- SHA512 c57eed984bd716de5f2889c68b776e11673b57f7f03513b40e3285ae5f3fc487ad4f672e99b7539bb514448643d2a07f7e40693d1b9401b8345f84f05539f891
- SSDEEP 3072:XJLxqB76ZepgiHpOGYGKk7YC/mxvWvbXa9XNExSCpMW90KImQijndBbY6cSeq2nV:px5GXuXcSCpMW90KImQijnfb6nRtjU
- TLSH
  T183245BD826964D7AC87E53BE9191214603F8E016D603E78CEBE9B4F47D63B21CB05B4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Adds Run key to start application
  persistence
behavioral2
- Target
  uxcryptorbypidori/dnlib.dll
- Size 1.1MB
- SHA256 97ef5328d1d1703924c48d9cd1d45b7227fe3836e116dcded623b6a0dbd52c23
- MD5 c087c70deb98db9d0b046d0a3d0e582a
- SHA1 f195b25b9c2d85006e15dce3b0b22eab6a4d16a9
- SHA512 9a1c40ef39ea5cb28ace6ba069b1afbf55ca47e4189b06d3cd033cbf7d01a838e7b5edb0e8578547a219a312446a5c2daa68e784ba2fb5c1c799dcc4500ab24c
- SSDEEP 24576:ct140a1plV+Th8rQ7F/qy0EFXnh8MviJa319Iv7f1NGgV:LIwy
- TLSH
  T12B456C1137FD9B77E06F873AE835061903F1D406A697EF4F6A54ABAA6C833685C00397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  uxcryptorbypidori/uxcryptobuildeer.exe
- Size 10.4MB
- SHA256 9420eebc480c4bbc5a5979a7589ccd3cad8092fe423499b32e8d1b219fdd67ed
- MD5 612b3b31536d8bef7588624cccd1e62f
- SHA1 15499fa84938a908750780c6127025b5e3a27273
- SHA512 386019c075e9f4731f905efacca140aa2596a8f28b1f80b22f997873ced68f8cc3e50326d60e9c4ebcd03bb4e2855e4d109dbd7793b7a8bbbda5f6428717e52a
- SSDEEP 196608:ax4Jsy/LsiWQSXHsrS4hcEZ+lAH7P8PlL2V2nNgwQ+dtLct7kZ+2W1hRc:axs5/LsCazCU9L2VqNjYt792WS
- TLSH
  T147B63398777009FAE8B6113EC1024620EBB739676B15C1CB4741D7A67E23BF2ADB4742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Loads dropped DLL
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral4
- Target
  tmpnn_cr6pg.pyc
- Size 6.2MB
- SHA256 6e2a9e8ca54d009c325092b7f8400d3f44f41e6d5d31b7ba8611eeeab89bd816
- MD5 885f46b935513a89e3c4afe435f5274b
- SHA1 553938a720c32f5600fa56e43ceb6416b8db29a8
- SHA512 43585e1a1469346d0308e0e605bbb29d6d4e944769de33949a583a76039719cd4df1e81868574cf21d6fbaa48753799dabca3a54b7c2f350ca2423ac0c409532
- SSDEEP 49152:+6a7n9NHy9e5wOImvyRcXstgXhEMcoyM5odqtD7gLrMvsQePDvxkpM5B85rBApkj:U
- TLSH
  T17E6602118AC46FA9DFAC5A1D90FE161E53F04A8E941675CEEB337D07AFEB904020B1D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5