salatstealer | webrat[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
webrat.zip
Size 2.9MB
Sample260925-q3n7xaxeke
SHA256 48407aa91ce8b8d2715c2dc61152a01724ec89a827f236a4bd80ce47f1ac1edb
MD5 99bf9fc4b24dbf0eeed0e0c4dc28d534
SHA1 03ab214c28975e8b9a6017b6403c2ee30f78ba92
SHA512 dc74a69857b01d1f07b84e7644585f36c72bef8c928ec0f818146813a102496edf8c571b100b5f156d54bb970577eccd9453e178bd3bc396c196205b0c1f6933
SSDEEP 49152:SqbyMfCTZQk5SIsmmlfryFJai1qBrJ+5VTlwxFbsmSY/5g0TGM:Scy+0Kb5Wei4BrJWlwXA2g0L
TLSH
T1FDE5333EDA94468816C8F805BB3D7087374574E3DFE85DB4EDAC025463F5DB8029AA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer salatstealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
static1/unpack001/webrat.exe	family_salatstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/webrat.exe

File Explorer

webrat.zip

.zip 2.9MB
webrat.exe

.exe 7.0MB

webrat.zip

SHA256 48407aa91ce8b8d2715c2dc61152a01724ec89a827f236a4bd80ce47f1ac1edb
MD5 99bf9fc4b24dbf0eeed0e0c4dc28d534
SHA1 03ab214c28975e8b9a6017b6403c2ee30f78ba92
SHA512 dc74a69857b01d1f07b84e7644585f36c72bef8c928ec0f818146813a102496edf8c571b100b5f156d54bb970577eccd9453e178bd3bc396c196205b0c1f6933
SSDEEP 49152:SqbyMfCTZQk5SIsmmlfryFJai1qBrJ+5VTlwxFbsmSY/5g0TGM:Scy+0Kb5Wei4BrJWlwXA2g0L
TLSH
T1FDE5333EDA94468816C8F805BB3D7087374574E3DFE85DB4EDAC025463F5DB8029AA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Password

WEBR_EJXCCS53D8NU

webrat.exe

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 64d510e97d205096890f2ff6034ad3b34a9afee75ead335c47b84eebec3b6eb1
MD5 bb169646a8be1f4295c44d54299fe366
SHA1 8225024591e7087c99fb2ffadf1a272ce8a92216
SHA512 f34b69cf644859eac6d2abc7db36f94d9212a88b913f5cd4bbee9ba5f106983a2c10aa0234616e0dd816fbfadb2839290650d884fc2f204eb7e6bbf400b419d0
SSDEEP 98304:skESYU6ndpptmJ5n3CeaFOumvBh8huT+E:sQt6ndpXil3CFy
TLSH
T159763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect SalatStealer payload
Unsigned PE

Checks for missing Authenticode signature.

Password

WEBR_EJXCCS53D8NU

Minor OS version

Major OS version

Entry point

556288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

415KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

webrat.zip

webrat.exe

kernel32

generic