salatstealer | d42990f7f88b3352ea4edffdb7b4340fa34c7b42320d20735c19b9220e4d0466

Sharing

Copy URL Twitter E-mail

General

Target
zapret.1.9.9d.rar
Size 7.1MB
Sample260911-xteqfacq31
SHA256 d42990f7f88b3352ea4edffdb7b4340fa34c7b42320d20735c19b9220e4d0466
MD5 ed6e76a35549c2e2429b1e48e5b61adf
SHA1 53117e7e7953f46b11538ac2d1509d2dd7c7961a
SHA512 82809076678d3769898b7e5776f5476983e945912a3458f089f35c0fd28b07077e7055da60fdb4372bed8c002cc185063f51215c21a59d25074592b9c870d211
SSDEEP 196608:OJsggmFGDZrfQfS9Z2A1VF3Yx9ftsAXI+TO:OS4FGDdQq2A1VW+0I+y
TLSH
T1B07633A72FA309B694DDEC7251CBD6D6A020CB27844F781BC91D322BBE725D3039952D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  DiscordFix.exe
- Size 10.4MB
- SHA256 b00784d96811d72a503d8b4f84d32c3c509322fcfdfaa476637d4d425b51deb9
- MD5 0a2783c40c52302d3373ee18de5a1778
- SHA1 08e3005af13a40d18326fd5d1ad7580199cc1011
- SHA512 fc8f952a399595595851cd0d65a1122537ec433c8b14172981e27854824d94cf0c0d01afbb187549ab3482e0364bb80659bf1331c8cd8263d6a634af6ecf4507
- SSDEEP 98304:ijSTOEVpCX43rPl0swW+GV39E8pjxXhuJEH6V0AF60zK0V+sM5Eb:iwPpXbfV+mB1bul0c99V+Mb
- TLSH
  T196B6AE87FC9154E5C0AED3718AA791627B717C885B3123C71B40FA282F72BD0ADB9758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  bin/winws.exe
- Size 199KB
- SHA256 31d68a175abebab19f7f39bf6d0845ec5c18ab653eeeea6ee830b22d799b7e55
- MD5 f94c4b0110feccd6aeca48c93b278d8b
- SHA1 0148ac55f074a602d37db9031a8f33912ad427d6
- SHA512 cc45b7029bbff2cad44faec5f3f4a96a23365007101be9795b2dc7ad1c0184402160ac13deb97ddb01547be7803d35cdd79d5ec59a750ac33ec2234e076d280a
- SSDEEP 3072:u6iE1/fe+JgV/uCUsnD23WDTCT4+4Q1aRw0SKcVsa4jNKcdJbIk6D79th2y/lJ:r7JgrUsdDTQFDVsf5KQxIk6ltz/lJ
- TLSH
  T184146C17F3D688F9C462C17897AB6333E931FC452124EA4F6F94DB252F61E10A12E798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  general (ALT).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral6
- Target
  general (ALT10).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

credential_access discovery execution salatstealer spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7
- Target
  general (ALT11).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral8
- Target
  general (ALT2).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral9
- Target
  general (ALT3).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

credential_access discovery execution salatstealer spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10
- Target
  general (ALT4).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11
- Target
  general (ALT5).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral12
- Target
  general (ALT6).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

credential_access discovery execution salatstealer spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral13
- Target
  general (ALT7).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

credential_access discovery execution salatstealer spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral14
- Target
  general (ALT8).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral15
- Target
  general (ALT9).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral16
- Target
  general (FAKE TLS AUTO ALT).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

credential_access discovery execution salatstealer spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17
- Target
  general (FAKE TLS AUTO ALT2).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

credential_access discovery execution salatstealer spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral18
- Target
  general (FAKE TLS AUTO ALT3).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral19
- Target
  general (FAKE TLS AUTO).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral20
- Target
  general (SIMPLE FAKE ALT2).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

credential_access discovery execution salatstealer spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral21
- Target
  general (SIMPLE FAKE).bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral22
- Target
  general.bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral23
- Target
  service.bat
- Size 20B
- SHA256 2ca46d023677717ed34b28ba1d9a0c7c15771518b490e7beb46282864aa06c55
- MD5 69d2d3dec4b85fd93b8f4c0b6717ff24
- SHA1 c00c0701966ca4710880b1507f374300581bb211
- SHA512 efdba619f497f0ee712cde532b9c143b09dc33747efddcee1b2f061898c4f486ac47f43b1ad46c7fba05df521ab6b28368750c5c75c781a9120925b7c16e3a11
- MD5 SHA1 SHA512
Score

10^/10

discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral24
- Target
  utils/test zapret.ps1
- Size 36KB
- SHA256 afe31cc4ae3c00f37d001616cf0829fe9e087fd8ba747ca6a7e63495ddd7f7c5
- MD5 8ab659bdf90efc4f98f54bfeaf50f150
- SHA1 4660dc7359115bdbdf26f26618461871e88adc7b
- SHA512 e8be062d2def2dd5250509eb9f951df496c727979eee0e8b49dc5fa8209a0af6ad7af668a6461826af86a547e2d352e2830a966726a9926d754c21bfbcce08de
- SSDEEP 768:jzk3PDd6wC3VD5tloLsFiOswyBw41J7d8Bz5:FYwyBw4Xa
- TLSH
  T184F2B82AB90A206F52735BBFDC517104FF56017B404902D4BD8C60D87FF492EC6B9EAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

UPX packed file

Detect SalatStealer payload

Family: salatstealer