Overview

overview

10

Static

static

10

2026-10-10...ve.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-10-10_4f10dba0fa9ad82b6a531947fa69dd8b_hive
  • Size 9.8MB
  • Sample261011-rseq6abc26
  • SHA256 3cbb92385ec70adc79f268f093ffe54427d6d12f3e2212a9c515156cd126fa35
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
salatstealerdefense_evasiondiscoveryexecutionpersistencestealerupx

Malware Config

Targets

    • Target
      2026-10-10_4f10dba0fa9ad82b6a531947fa69dd8b_hive
    • Size 9.8MB
    • SHA256 3cbb92385ec70adc79f268f093ffe54427d6d12f3e2212a9c515156cd126fa35
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionsalatstealerpersistencestealerupx

    • Detect SalatStealer payload

    • Family: salatstealer

      SalatStealer is a stealer that takes sceenshot written in Golang.

      stealersalatstealer

    • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • Uses WMI to collect hardware manufacturer information

      Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

      defense_evasion

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks