salatstealer | 04e591e7d4feb2aea5705dbed6cf9cf027ded9ce9952f57031970e8ca6921bc5

Sharing

Copy URL Twitter E-mail

General

Target
Zapret.zip
Size 4.9MB
Sample261027-2q24saxtby
SHA256 04e591e7d4feb2aea5705dbed6cf9cf027ded9ce9952f57031970e8ca6921bc5
MD5 c9986303ce8acf80af095baa39f9efa8
SHA1 82e1c2f621f2dc1f3ba26f7d3845f13858cc744a
SHA512 cd7bc816f194b37babed7e06264f731edfa23febbe99d3cec94319f0df55c21d4ac7473fef288ee8d3198668d6339bcd66bcb4777c61d6460195980671a08d1b
SSDEEP 98304:KyfrSi1IHQjo3vcH2C9jk1MKAMq4kZWH7A2X8CuuTARcJ:KyzSi1IHQo29jnMq4kZ+7CCuuTv
TLSH
T10A36335F44565832DF2CB8BA6405574B69CCFFE6F6E40B432872E5B138E6BB2A316103
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  zapret-discord-youtube-1.10.2/bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  zapret-discord-youtube-1.10.2/bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  zapret-discord-youtube-1.10.2/bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  zapret-discord-youtube-1.10.2/bin/winws.exe
- Size 3.5MB
- SHA256 3d6fca3ad48c89cc16a5c9022798f2880775382591d2bceb7370274f26bf27dd
- MD5 ad9cb53b102f6921ee794c332b372837
- SHA1 e576083f95f337a255d0b704ea15cbbf9975cbd0
- SHA512 7b03d11ef1be2b7572bbce3746d6d7ce5d7feeac3ed8e55b38da46e77e7ce8cd1babfaee9244e7e7ff2c8cf01a69a558508daf8e3c0bf8f7bceb3b79e78b0742
- SSDEEP 49152:1mSZu9VTPycDHT+RPkzhE8koY6ILyTaL/tmf9z8za+u4U+9jC2B+Er98LyijYy3R:1eD2cDz4PYGoOmaUVAzBU+9MeOyBix
- TLSH
  T19E06335B45D69C32DB3CA07A9412275B44C4EBFAFED04F4929B6E7312AF53A0B21B113
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral6 behavioral7
- Target
  zapret-discord-youtube-1.10.2/general (ALT).bat
- Size 3KB
- SHA256 94d40f898fcefe075d54895200c85c264a7d0d0b2842a6825b68ffd5d9c07ab7
- MD5 7edeb6dbd5d8f5f72e53adf52d0bba43
- SHA1 0ddb26f09027a5d6bf2ef0f135daccb4d4a0337a
- SHA512 76efd594ed332884ce4d853f041ada23ad71f4060e1c89624ab943a323502ee8a1970296d0e1bc0a2a333cd4d3caaeac6c558b2da3b273c268bd419b433e88f0
- TLSH
  T15B814BA7E00CDE47F5CD653EF85FA5A420279C8328D6D456835B89E8CC4EDBE684E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral8 behavioral9
- Target
  zapret-discord-youtube-1.10.2/general (ALT10).bat
- Size 3KB
- SHA256 6b41d2813aefd7e9328ed42dad7de18ab8bb1bb72c3ed3a9221a9de34e2eb6db
- MD5 c8b5ab05d87ba654d4b60905d826ac42
- SHA1 ab426209e125921ff9dae3d4e534f4b9eeaacb6b
- SHA512 3dedc3bc7046dd710979ae6cdd44a762290d50aab34d3a8c585c97df0ae8dacf102a99137009db32f85faa29c4965f4ad47abd1869a12665a277d8f86c49bbbc
- TLSH
  T154712BA7E00CDE47F58C697DF85FA5B42127DC8328D6D456439B89E8CC0ECBE584E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10 behavioral11
- Target
  zapret-discord-youtube-1.10.2/general (ALT11).bat
- Size 4KB
- SHA256 a695954558273b5bdec5948a562245d83b9d7c556f1c26315f2a47a33dbd9072
- MD5 1ce6ddb72c2129df389bfe447b2dbcde
- SHA1 331d97a9b428779e6913fe6e22b62cc356377229
- SHA512 c7cae3a7a5da4b715a0c8a6512dfb886210d77a756fd9807674b6b9f0736963ff80c13a7f8f3235e5cdadf5e9f543126e13c179163743baa23aa9115cf3e6691
- SSDEEP 96:nL67mQGB/GRRQ1zbIKdUGB/GRwVv/GRRQuv/GRw5P+R2rS5+RRLx/:AmQGB/GRRGEVGB/GRUv/GRRDv/GRkP+a
- TLSH
  T1C5915CA3E00CEE4AF6CE757EF45FF6A5201798C328D6D452439B89E8CC0EDB9195E084
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral12 behavioral13
- Target
  zapret-discord-youtube-1.10.2/general (ALT12).bat
- Size 4KB
- SHA256 1f8b883822704207974c6da91f6a31e509569f917dfaa52688fba450e3298e77
- MD5 cf26f4609789f8317aaa753d071d9628
- SHA1 43e0ff240b92bcf0123c6492d9bdd4bead3bdfec
- SHA512 03459a91dc726e9a43689209d180177f0efe43c87358c602c32f7d7a40b3886bc328218e49acb42b5552814bf1f33c64cf0f7190451b8f9d13230c999548d418
- SSDEEP 96:nL67mQGB/GRRQ1zoLIiUGB/GR6Vv/GRRQuv/GR65P+RmjS5+RRLx/:AmQGB/GRRGl1GB/GRKv/GRRDv/GRuP+4
- TLSH
  T152816DA3E00CEE4AF6CD757EF85FF6A5201788C328D6D452439B89D8CC4EDBA594E085
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral14 behavioral15
- Target
  zapret-discord-youtube-1.10.2/general (ALT13).bat
- Size 3KB
- SHA256 0ef7279f222ced580f002c4073cc431307a368d6a70016489fc09e7a1741b0f8
- MD5 f32605507f97f3762b7c13c3a5804858
- SHA1 2e1b313d8d6ad50d385c7be5fbd30ed3fb297e8e
- SHA512 d906ac907d089868b4b9e97a6f3c4ba09bfaa55a6a213d5a09e9866d763bd25c5fef6c403c71cb1103abad17d60a136705b098f7ced1f6f688aec68cd959d8fb
- TLSH
  T1B7818E63E00CDE47F5CD697EF85FEAA16027888728D6D452539B49E8CC0EDBE684F481
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral16 behavioral17
- Target
  zapret-discord-youtube-1.10.2/general (ALT2).bat
- Size 3KB
- SHA256 f928a447fd312866c02e3a06519537c892424c9133a6ec91ee741664ff17595e
- MD5 19740924254d81f4811a6704e7fa3246
- SHA1 33515547dea40f040a95ed90d161dda34a02f695
- SHA512 12222b2c13d15b57a88701beab9e56b56702b4c9942927280ccd1d0e0070802ce8fb772f398a29c920570e0b5bacd4d316875788fbfee1a9382ba6954ec51479
- TLSH
  T19A610757E00DDE4AB68E783FF89EE5E42017C8C31CD6D452539789E8C84EDFA494E485
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral18 behavioral19
- Target
  zapret-discord-youtube-1.10.2/general (ALT3).bat
- Size 3KB
- SHA256 60a821b459d080568a7463ba349da64ad69e65f831078414765e0eb1d365bb0b
- MD5 46aa2265ca541308efe1cdf54ccd7ba3
- SHA1 8c5bfef00d7268c217dc009d8c900f34fc669148
- SHA512 fa1f80a41b22aadd15b62cb68cbe5a56e5cc29e1e260c918a177b76f09c3e9b7b71adc23643bba666bb50ec231ecbf74b9e345bcecdcd5279134ba86fe1b4c07
- TLSH
  T18F715B93E00DDE46F5CD687EF84EA5B56027888728D6C85152DA89E8CC4EDFA6C4F085
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral20 behavioral21
- Target
  zapret-discord-youtube-1.10.2/general (ALT4).bat
- Size 3KB
- SHA256 589e0bfef2bac1c18100d768e40fb593757be44028175be800d8953411007d25
- MD5 ffc6031195ea6e9bc4ed2748910452a9
- SHA1 b1d31c9d8755757d44051432292c1e2f4b05643e
- SHA512 ea9f26eb2270231b8838a75f8ac8d36ac3392abe6a6a75052cd1c4cfbf6c275704b94e636f8a7cb69ae6277df20f47679768871f5271e00f607fd3770486c839
- TLSH
  T1F6815A93E00CDE46F6CDA53EF86FA6A421179CC318D6D452439B89F8CC0EDBE584E594
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral22 behavioral23
- Target
  zapret-discord-youtube-1.10.2/general (ALT5).bat
- Size 2KB
- SHA256 a81c276ecae34c3c39c5d862bbf1ef841ff04864bd854485178adf5a8121f9f8
- MD5 2ca56a417d5ef64ae7e8c0b58fedeeba
- SHA1 6413271c89dc8674e29602977a1acd0d9237871d
- SHA512 5addc0f3d27a840db184f01b3152c663e52af6ae73082b30481bd087a26b63a31c492eaa9682b0d0de5e4bf9a7827c8055db290b20c2bcbbed12604f8fdaed1b
- TLSH
  T1E0411387E00DDE46B48DA83EFC5AA5F5701B98C32CE5D466539788E8C84EDAE8C4E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral24 behavioral25
- Target
  zapret-discord-youtube-1.10.2/general (ALT6).bat
- Size 3KB
- SHA256 ed7a09a6686191fa8a2bf733b5b4d26fefa45c92b62266e1f94bb56aeffcd079
- MD5 c3ff7ea1add327011ee6730b4053966d
- SHA1 4e2eae34810683c4484cfadde15e5a1453e23fe6
- SHA512 76ded952ffe8406af1588c2163cc66851a8605fdb9e165f94d81a3e8e8d48287d434bb7c6a145561820ec4dbf83b3cf13a06d05cb17bca6474a8936d026e2b7a
- TLSH
  T135611657E00DDE4AB6CEB83FF85EA5E52007C8C31CD6D452539B89E8C84FDBA494E485
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral26 behavioral27
- Target
  zapret-discord-youtube-1.10.2/general (ALT7).bat
- Size 3KB
- SHA256 57cb714ea0e385ab3cea37543fd9ac7d591142571192217b39a6ce7c04f85f15
- MD5 96e72a33cf63c887ef194cedd6ee22db
- SHA1 0e5a8595f435fc4d01be203da895f5117fe585ba
- SHA512 83c853db87e8e37ba5dbb02ce35d88833d5a11dcb6c8bc3e4ab21506878385d38de720fd5ac022ab85eb1e2f473daf14aef4fee5fcd11f83f66fd79c923b0f86
- TLSH
  T13751F797E00DDE46B68EA83EFC9AA5F52017C8C31CD6D462539789E8C84EDEE4C4E485
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral28 behavioral29
- Target
  zapret-discord-youtube-1.10.2/general (ALT8).bat
- Size 3KB
- SHA256 cafefaafde22fbf9316a2abe5fcb916c23cb9a820b39cad95317a2b734486d1b
- MD5 e31fd8c5e8dc5f37928441fa43826ab3
- SHA1 89d2ea47abdd51792ee0a6696d715830b850fe30
- SHA512 87ef1ecde967076f02f26c4b776e69c513ba5e4d0818bedb24fa1d486cfc9a668f6a60ffa7bd2ce766c9fc2448a7667a7fba214d42bbb2f36544e0d2fdefad3e
- TLSH
  T10A714993E00CDE46F58CA83EF85FA6B42127DC832CE6D451539B88F8D84EDBA584E584
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral30 behavioral31
- Target
  zapret-discord-youtube-1.10.2/general (ALT9).bat
- Size 3KB
- SHA256 56430f0594058f6a1585509a0b52a532348d9e9913c723a4952fa8009c079d43
- MD5 887f170da8b6c662cabb459d142cc7a4
- SHA1 c32a4eea7583550812d67cbdd3926c087abb6153
- SHA512 0595cb2cfac83211e26d32e2cde40741df4ec7d744843c8f5dad6abd06409d60ad33227b914205a5d336415d39027c31dc1f57837b76e026b14bf87fe1168d7f
- TLSH
  T177616993E00DDF4AB58D6C3EF89BA5B52417C8872CE6C851638689F8C84EDAE5C4F485
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery execution salatstealer persistence privilege_escalation stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect SalatStealer payload

Family: salatstealer

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Contacts third-party web service commonly abused for C2

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Contacts third-party web service commonly abused for C2

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Contacts third-party web service commonly abused for C2

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Contacts third-party web service commonly abused for C2

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Contacts third-party web service commonly abused for C2

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Contacts third-party web service commonly abused for C2

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Contacts third-party web service commonly abused for C2

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Contacts third-party web service commonly abused for C2

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Executes dropped EXE