salatstealer | 2026-10-01_5a22f661ec35ba796399e8bbceb20f1f_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_5a22f661ec35ba796399e8bbceb20f1f_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch
Size 12.3MB
Sample261002-reg95abg25
SHA256 d673b8ed0a7f2b4c16afd8834ea68cb4157c3a3c7e5c14cb20756d03246c6df3
MD5 5a22f661ec35ba796399e8bbceb20f1f
SHA1 5fb53b5d69c278efb0796ea2e8612d237e5ca98e
SHA512 5395c9ca1c5a59efbcd078cd5baff0d26f5604ece5aaec75dbdaeaadbffae37b890143ad420d3cd1813db848debd7858d0a2169836924f58b2bc6b43155c6272
SSDEEP 49152:xmenTwtmDosGnBtEbhiqh6vmSqRzxW1CxbeSgHN4dQaEds4zRgX9FnCJJZip7iYI:BnktEbhxY+SaxHmhTDZf3b4+RE
TLSH
T169D65C01FECB54F6E903593541ABB23F63315D048B24DB9BEB183E2AFC77A91197A244
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx stealer salatstealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
sample	family_salatstealer

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_5a22f661ec35ba796399e8bbceb20f1f_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch

File Explorer

2026-10-01_5a22f661ec35ba796399e8bbceb20f1f_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch

.exe 12.3MB

2026-10-01_5a22f661ec35ba796399e8bbceb20f1f_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch

SHA256 d673b8ed0a7f2b4c16afd8834ea68cb4157c3a3c7e5c14cb20756d03246c6df3
MD5 5a22f661ec35ba796399e8bbceb20f1f
SHA1 5fb53b5d69c278efb0796ea2e8612d237e5ca98e
SHA512 5395c9ca1c5a59efbcd078cd5baff0d26f5604ece5aaec75dbdaeaadbffae37b890143ad420d3cd1813db848debd7858d0a2169836924f58b2bc6b43155c6272
SSDEEP 49152:xmenTwtmDosGnBtEbhiqh6vmSqRzxW1CxbeSgHN4dQaEds4zRgX9FnCJJZip7iYI:BnktEbhxY+SaxHmhTDZf3b4+RE
TLSH
T169D65C01FECB54F6E903593541ABB23F63315D048B24DB9BEB183E2AFC77A91197A244
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detect SalatStealer payload
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12922704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths