Overview

overview

10

Static

static

10

rat(2).exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    rat(2).exe
  • Size 7.0MB
  • Sample261020-mdhgaayvbx
  • SHA256 e46b8b30d115c742680b31a794e1cd10c7d04c8cf0bbf6d80a311b004a85dbb7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
salatstealerdefense_evasionexecutionpersistencestealer

Malware Config

Targets

    • Target
      rat(2).exe
    • Size 7.0MB
    • SHA256 e46b8b30d115c742680b31a794e1cd10c7d04c8cf0bbf6d80a311b004a85dbb7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasionexecutionsalatstealerpersistencestealer

    • Detect SalatStealer payload

    • Family: salatstealer

      SalatStealer is a stealer that takes sceenshot written in Golang.

      stealersalatstealer

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Executes dropped EXE

    • Uses WMI to collect hardware manufacturer information

      Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks