salatstealer | 040cfbf765c7fa78ae099c6cbb5e6d03e6c65270d5dee136ee251310a402692d

General

Target
file.exe
Size 637KB
Sample260924-1bejhasfma
SHA256 040cfbf765c7fa78ae099c6cbb5e6d03e6c65270d5dee136ee251310a402692d
MD5 f7b2f90781c797701bedd52748209ea7
SHA1 22f74cc47ef5d3c7d5236a28ba0401a2ab014714
SHA512 b95940005d77bc6172360ab598276116096802581f97b43c13d700c311dba56986d8fa623f9f59cbca3858cdadad5dc6a832ea4bb9b5bddc828c18517bde24f3
SSDEEP 12288:bF91nyPh+c+U9b2t5jav45vlXsz0LFqc8BcbSlddNo:bF9d3U4Ht5vl+0qc6ml
TLSH
T148D4F13BB2A424FBE13096BB46911193A7E7F8998720D7E79A69360C2C53DDC4F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  file.exe
- Size 637KB
- SHA256 040cfbf765c7fa78ae099c6cbb5e6d03e6c65270d5dee136ee251310a402692d
- MD5 f7b2f90781c797701bedd52748209ea7
- SHA1 22f74cc47ef5d3c7d5236a28ba0401a2ab014714
- SHA512 b95940005d77bc6172360ab598276116096802581f97b43c13d700c311dba56986d8fa623f9f59cbca3858cdadad5dc6a832ea4bb9b5bddc828c18517bde24f3
- SSDEEP 12288:bF91nyPh+c+U9b2t5jav45vlXsz0LFqc8BcbSlddNo:bF9d3U4Ht5vl+0qc6ml
- TLSH
  T148D4F13BB2A424FBE13096BB46911193A7E7F8998720D7E79A69360C2C53DDC4F39710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery spyware defense_evasion execution salatstealer xmrig miner persistence privilege_escalation stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- XMRig Miner payload
  miner
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2