salatstealer | 517e2b7b2027e868f01722d53d5b0bfbc4436258fa189d9430e3535ae390f2f4

General

Target
mellstroy.exe
Size 43.7MB
Sample261016-yydvdact7j
SHA256 517e2b7b2027e868f01722d53d5b0bfbc4436258fa189d9430e3535ae390f2f4
MD5 477d191b846c63709c171033a7a6b143
SHA1 e12a53fc8d503f23e58dd08dbc05fe12b449e9c6
SHA512 607d3adf19abfeb47974575b27702665e3080add8fe24849631d4918b1c73dcb5554549125a96ebfe59b2399e97024c44aeb0bd5086d3cd65c169ee4ee3746ee
SSDEEP 786432:/4rKVIpFZ5aZW42aR1UPIDkKY3gy3MI5ED9eM+L82kBxNjrrbd+f1r4Os:/uKOpFDkRh1ozKY/3MI5ED9187uxNjPT
TLSH
T1F4A73302BBF59DEADC62A13C918B6319AA35BCA0079796CB535023315E137E8DC3EF15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  mellstroy.exe
- Size 43.7MB
- SHA256 517e2b7b2027e868f01722d53d5b0bfbc4436258fa189d9430e3535ae390f2f4
- MD5 477d191b846c63709c171033a7a6b143
- SHA1 e12a53fc8d503f23e58dd08dbc05fe12b449e9c6
- SHA512 607d3adf19abfeb47974575b27702665e3080add8fe24849631d4918b1c73dcb5554549125a96ebfe59b2399e97024c44aeb0bd5086d3cd65c169ee4ee3746ee
- SSDEEP 786432:/4rKVIpFZ5aZW42aR1UPIDkKY3gy3MI5ED9eM+L82kBxNjrrbd+f1r4Os:/uKOpFDkRh1ozKY/3MI5ED9187uxNjPT
- TLSH
  T1F4A73302BBF59DEADC62A13C918B6319AA35BCA0079796CB535023315E137E8DC3EF15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution salatstealer xmrig miner persistence privilege_escalation stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Suspicious use of NtCreateUserProcessOtherParentProcess
  defense_evasion privilege_escalation
- Windows security bypass
  defense_evasion trojan
- XMRig Miner payload
  miner
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2