salatstealer | fa415439d4795f64b1b2e736ee9b74df1aab827c8cefcd13dad5ce5d64ebee80

Sharing

Copy URL Twitter E-mail

General

Target
zapret-discord-youtube-1.9.9c.zip
Size 16.2MB
Sample261020-gxe8dav16k
SHA256 fa415439d4795f64b1b2e736ee9b74df1aab827c8cefcd13dad5ce5d64ebee80
MD5 067205f3b9a38e2eb1a1127d2d33ccb1
SHA1 152ed867ff7774e7646650cb4a228129a840268f
SHA512 e6b50e65834c2124fa946bbac0800857743b73bb485b3eaa3689279678d55ea3421b1c7237d62bc88eb5a56734a9d33d94782409fe8d4ef9beb7b423da57a0cb
SSDEEP 393216:Mcc37br2AJmvcIy1Icc37br2AJmvcIy15cc37br2AJmvcIy1ZOZwVAoEnVGYmG:dcrbjh1pcrbjh1Ccrbjh1AZwVWnViG
TLSH
T1C00733F785290A97E87B470036035C73B8F1951928588E8B3AFDB0CDA559CB7F47AC68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  zapret-discord-youtube-1.9.9c/bin/.wd/wdvcache.exe
- Size 3.4MB
- SHA256 85bfe327c64e66f71f7da0a1b0d84e6d46ce422610ae08d265be09c59ddea514
- MD5 a613ba2bc9ef26d8ce2f461e5e918bc5
- SHA1 8ea5196f4408f8c552ebe5b1176784ac5ae8e744
- SHA512 276ebe09017d56424fa9b0b1f040ea90b5f9a3814cede78b977d9d2c6794e8dbd668f174bab52991621e0b415e322d42d54703d44a97d39f0a4104f7750d6af2
- SSDEEP 98304:niJ2oaNEfaVbzxGvBkBWZGVLTfh7wpEES4O4:iJiafuIO7rhWEES4b
- TLSH
  T1CEF5335BF1AB47B3F7D9A931560FC66458B09FE40A20D38AD4DBAADF0886BD0C241375
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  zapret-discord-youtube-1.9.9c/bin/.wd/webrat.exe
- Size 3.4MB
- SHA256 85bfe327c64e66f71f7da0a1b0d84e6d46ce422610ae08d265be09c59ddea514
- MD5 a613ba2bc9ef26d8ce2f461e5e918bc5
- SHA1 8ea5196f4408f8c552ebe5b1176784ac5ae8e744
- SHA512 276ebe09017d56424fa9b0b1f040ea90b5f9a3814cede78b977d9d2c6794e8dbd668f174bab52991621e0b415e322d42d54703d44a97d39f0a4104f7750d6af2
- SSDEEP 98304:niJ2oaNEfaVbzxGvBkBWZGVLTfh7wpEES4O4:iJiafuIO7rhWEES4b
- TLSH
  T1CEF5335BF1AB47B3F7D9A931560FC66458B09FE40A20D38AD4DBAADF0886BD0C241375
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery salatstealer persistence stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  zapret-discord-youtube-1.9.9c/bin/.wd/zapret.exe
- Size 3.4MB
- SHA256 85bfe327c64e66f71f7da0a1b0d84e6d46ce422610ae08d265be09c59ddea514
- MD5 a613ba2bc9ef26d8ce2f461e5e918bc5
- SHA1 8ea5196f4408f8c552ebe5b1176784ac5ae8e744
- SHA512 276ebe09017d56424fa9b0b1f040ea90b5f9a3814cede78b977d9d2c6794e8dbd668f174bab52991621e0b415e322d42d54703d44a97d39f0a4104f7750d6af2
- SSDEEP 98304:niJ2oaNEfaVbzxGvBkBWZGVLTfh7wpEES4O4:iJiafuIO7rhWEES4b
- TLSH
  T1CEF5335BF1AB47B3F7D9A931560FC66458B09FE40A20D38AD4DBAADF0886BD0C241375
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery salatstealer stealer upx persistence
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  zapret-discord-youtube-1.9.9c/bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  zapret-discord-youtube-1.9.9c/bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  zapret-discord-youtube-1.9.9c/bin/admin_guard.cmd
- Size 278B
- SHA256 f052bc89afc47ae53e922859c580e685c07145d7f6f56d84f380a9d97fcb126e
- MD5 e9a9c63502ba81e7723cd106f464999b
- SHA1 4768deb0c50bd06c2f41e6f8635f76d27da23763
- SHA512 7ffc4f76b32ef6778d0910664fa7d1394634be6ddf729b0cef76a6cb22d7c92177a469cf65a428588d8101aa9e7b59d206413489519071f0a2995619186933f9
- TLSH
  T1DFD0EB0602885A7B8AFECB0042F94AA3DACC43CF122632C230F4D211F8CA441C6C0E81
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral11
- Target
  zapret-discord-youtube-1.9.9c/bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  zapret-discord-youtube-1.9.9c/bin/defender_guard.cmd
- Size 1KB
- SHA256 197ce86f9c1067a7ce07a50cb582befb861b4e187bc9818b88175651e9f91932
- MD5 93543e0e49904c2c3cb729b203ea475e
- SHA1 7e561d30fb2568d06ad2249e77850593ad9764d4
- SHA512 0434e8e5c5f57f6180d15fcd5ba8371e1399682d815aa433d1499e33349b74aedecf2a00254ebf428a2c3d17eaba5fcaf500c2d63cb9264eb9ec8f5a66a77bbd
- TLSH
  T16731464A921016FDC3F9064415C353A8F78B4099E67DD7C11897822BE53944B8EFDF2A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral14 behavioral15
- Target
  zapret-discord-youtube-1.9.9c/bin/extract_guard.cmd
- Size 363B
- SHA256 fb4030fdab4f882d1600036287381826411386dac9d4a126fca074cda0c13dbf
- MD5 74fd49efb7855253f318c689d4819dd6
- SHA1 e1a1785761043b47adac84df5af2012c1fb1dc25
- SHA512 e447d04c358c232576327796238f5682432efd2523fc7c99093bdb16c009a733ab51c350ff66fd34cc3caeb6e541f1e9308e3f4f82d1b3bd9076f36d862834a8
- TLSH
  T19FE068A9B2637C26202816D02F71205C6CC302F757CAADC1A8F3151834AA2B877860B0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  zapret-discord-youtube-1.9.9c/bin/gbzap_lists.cmd
- Size 1KB
- SHA256 9821d5236f7025adca57195a1d5069554e1980f3e52c590a27bbdaa092a5a883
- MD5 47de6b70ea0a15d01d467246f250c6ea
- SHA1 b68d3ec11ca13f05c275f9e98e88149f06fb26eb
- SHA512 e76e873be5169881636cd113160bb17e2b1eb7e1bbf0e3df05879e68d37c3d92b9506da3a28de55e13453241b1539983f72ce0b03bd5e3f8bfe79975471257bb
- TLSH
  T1612108F8C1081480DCF4B1BFF10A80A5F67A68D35C40D96D3D6199ABA66FB47CE9B46C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  zapret-discord-youtube-1.9.9c/bin/gbzap_seed.cmd
- Size 185B
- SHA256 b7fa470a7793972c8517680f209dc74231980634851ee51e9ee0acd0203f2617
- MD5 d4482d0a5a5fc495aa65068e958c0713
- SHA1 56d6cbe9ab7549378f215ce22cce3b6e8d974597
- SHA512 de0948c1948418b2e9ae1f5bfb58e7b4aa00104029f45a489f38e5212b7ce924e8dfd4064ff77c29aafc4be4ecfd7a6f5b5d1b7f07224b40f17f70b4fbf07dcf
- TLSH
  T10AC0126F04401E59D81C1E8822E0083266D513CBD50B2DE011A2880BC04557081DAED9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  zapret-discord-youtube-1.9.9c/bin/payload_fail.cmd
- Size 578B
- SHA256 2fbf2b977310f1b4179396e04b25b731995856f795492394ae19364662449bae
- MD5 6986af1ea19d757c6961f543e3dcca08
- SHA1 b5f8926b4b6e3511215b4feb43e0dbb3a774a2a8
- SHA512 f6514f1901a898f41fa4c25a694bb115936130abcdaf115cc85bc0ebdd8bec5200de8dc409007c6d3f4c1c60f8893d38c578e9ab4e52b080a9853bb373490c86
- TLSH
  T1C1F028B216A0B84F5000D54ECE199A4A3CDB00FF2CDA668315B16C7D34E9184E57E91D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  zapret-discord-youtube-1.9.9c/bin/payload_fire.cmd
- Size 379B
- SHA256 d760ebd00d5737f3075a72284047ec42a2ce96a219e74fde557ae8b0493e157a
- MD5 0c2110bd9b0c957f85a54d196e7b0ce8
- SHA1 0b9b4538f9188a47ab33724938f6cf0f3f63a838
- SHA512 69d1d24a80a1dafea56b5f9bd9ec1696ef0bb5cfc252031b9f9be616d5b0d399556b477ce049ce08e113ce32d81d7a6ef59a4a4a52d47ec77e0ac21472724731
- TLSH
  T1F3E06D30A40402215AF1267D06A328D7BE86C36AC32C40C0B0AE697AC9BED4F60DE2E5
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery execution salatstealer stealer upx persistence
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral24 behavioral25
- Target
  zapret-discord-youtube-1.9.9c/bin/payload_kick.cmd
- Size 553B
- SHA256 895e1319c45dbe2c440116d3050e72abddc807d99e6fa7d9313507150f72514d
- MD5 15d3975a7d66e59613060a91ea996e01
- SHA1 22a7d7038dd57c5c6737abea1b523dd4aea92d8a
- SHA512 bcecc108a1e38ff79a81adb3fda95760c9e5a4c05a7f4a7c94c67488ae9638db3d169e6caef338d05f16068c184a1dd0996b6ffcccaa34d77044db5199868070
- TLSH
  T17FF0BB2FD9004C257C6325D183E91562D9CFE35B4F4877C070E0945DA46F31885FC9EA
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral26 behavioral27
- Target
  zapret-discord-youtube-1.9.9c/bin/payload_run.cmd
- Size 737B
- SHA256 84fea0e7e3c3b77e8efe70ac9a39a9653c2954701ef782890dfc75c164c4e09c
- MD5 cf81640910bf9ccca163fbbf74e7769d
- SHA1 5cf04c4aef65ef5efb314dca01efa9276b5c0709
- SHA512 7fbf0e22387866a67eda2d42b52493e3c31e2eecdd9ed56873626504e9cda0fefe6b80cafb860a680de889508a2e1b431bd6aab45e7d7d1b37992ff86c4578dd
- TLSH
  T15E01D82DE12158D4C8F19AF406CA05D65A67BBB3877C87C3706584CDE46720E81B9DCD
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery execution salatstealer stealer upx defense_evasion persistence
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral28 behavioral29
- Target
  zapret-discord-youtube-1.9.9c/bin/wd_cache.ps1
- Size 2KB
- SHA256 f00648076fccb5c0282757ae461d8374b71b2eaf717dd630e4ba02cb029d9e14
- MD5 6aa03feefd69dcc9b8045267033fbb88
- SHA1 f66d1c6e8f6b2429ee83e7b59056205784ac06de
- SHA512 8ef2f632da933070adff21512148b6e092a6bc744ac248b33754f47bc75f5acb0b865e235308b70bd91517ec1c82ccd8ecb48a28b37321e9522203123d3e501d
- TLSH
  T19F513025F21AC59A4AC5613B1488C8989A39183F404C7E0C369FD748FA75B5C87FCBF4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  zapret-discord-youtube-1.9.9c/bin/windivert_drv.cmd
- Size 1KB
- SHA256 9666f4fd350b4a9629618e61b02bdca4e63ecbe560b1d5482c427b0779470b16
- MD5 dd840282cfb304893dfd89cf4160c927
- SHA1 37c55d1b9548ee0e7981152d90ad0d465a0f163f
- SHA512 d928270011cd4b367d43f09130e92d9070062b7818b8944cafe5c5db835016e340a976eca6d3ab73aa809aceb0ba54fe879ef83164e8e4be92826f5bdde6caea
- TLSH
  T17931245617302FF281FA06909AD706D8FA87C15DD0AAA7C16455C206E81650F8FBEE39
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes a file named after a Windows system binary

Executes dropped EXE

Adds Run key to start application

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Adds Run key to start application

UPX packed file

Command and Scripting Interpreter: PowerShell

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Adds Run key to start application

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Discovers running processes

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes a file named after a Windows system binary

Executes dropped EXE

Adds Run key to start application

UPX packed file

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32