salatstealer | c269ac5f54538f50458601d18be7729fa739d46a48ef4571c7a9b5f626385f6f

General

Target
2026-10-22_c0ff8cb02c635ee20fadec24321807b5_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch
Size 12.6MB
Sample261023-1rb4badf99
SHA256 c269ac5f54538f50458601d18be7729fa739d46a48ef4571c7a9b5f626385f6f
MD5 c0ff8cb02c635ee20fadec24321807b5
SHA1 bfd628d7a9e8681f38933a8471a9c7b8b1c87101
SHA512 4b8bf5b1643732202e6b20e86778fc6a40985ea46ca2ba87b8633966a3141285fff84a16b6862c1b34f774ae5ed6d5548b18e4bd0564d50495aa48c76cf0d8f7
SSDEEP 49152:8uvRqBhGWQeh6IAlpC9h4EeOCJqixEw9U9di4i2wvdQDVOgt8G7VCh/f115UZjwG:3RehepCzvrC/xIRLil5+Mn41NEtO/
TLSH
T119D66C11FACB54F6F9035831406BB27F23355D048B24DB9BEB583B2AF87B69118BA705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-22_c0ff8cb02c635ee20fadec24321807b5_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch
- Size 12.6MB
- SHA256 c269ac5f54538f50458601d18be7729fa739d46a48ef4571c7a9b5f626385f6f
- MD5 c0ff8cb02c635ee20fadec24321807b5
- SHA1 bfd628d7a9e8681f38933a8471a9c7b8b1c87101
- SHA512 4b8bf5b1643732202e6b20e86778fc6a40985ea46ca2ba87b8633966a3141285fff84a16b6862c1b34f774ae5ed6d5548b18e4bd0564d50495aa48c76cf0d8f7
- SSDEEP 49152:8uvRqBhGWQeh6IAlpC9h4EeOCJqixEw9U9di4i2wvdQDVOgt8G7VCh/f115UZjwG:3RehepCzvrC/xIRLil5+Mn41NEtO/
- TLSH
  T119D66C11FACB54F6F9035831406BB27F23355D048B24DB9BEB583B2AF87B69118BA705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- UPX dump on OEP (original entry point)
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect SalatStealer payload

Family: salatstealer

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers

UPX dump on OEP (original entry point)

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2