salatstealer | 7840b0d3ccc90a410e3df5c08bbf055a9a5906cd8784e33732058891ebc4aa5b

General

Target
Loader.ps1
Size 494B
Sample261009-wkk1esdc49
SHA256 7840b0d3ccc90a410e3df5c08bbf055a9a5906cd8784e33732058891ebc4aa5b
MD5 bfc6be619738659d0756cc01fe838a9e
SHA1 5812d31d37566698ca09c0b10d41032882f7c7cc
SHA512 52045b6c1d8262a6345d6ec4ba3c9412148f848d8d7a00a53e38ff54c4094e4ffbe49089633c021d3f82760e295bf7cdae247697e0d7e9acde10910fe25bf320
TLSH
T15BF0545302DF4B9B085D10F2002C985CDACE815261A12C1237B0EFE097CB6FAD1FB384
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Targets

- Target
  Loader.ps1
- Size 494B
- SHA256 7840b0d3ccc90a410e3df5c08bbf055a9a5906cd8784e33732058891ebc4aa5b
- MD5 bfc6be619738659d0756cc01fe838a9e
- SHA1 5812d31d37566698ca09c0b10d41032882f7c7cc
- SHA512 52045b6c1d8262a6345d6ec4ba3c9412148f848d8d7a00a53e38ff54c4094e4ffbe49089633c021d3f82760e295bf7cdae247697e0d7e9acde10910fe25bf320
- TLSH
  T15BF0545302DF4B9B085D10F2002C985CDACE815261A12C1237B0EFE097CB6FAD1FB384
- MD5 SHA1 SHA512 TLSH
Score

10^/10

execution defense_evasion discovery salatstealer xmrig miner persistence spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2