Overview

overview

10

Static

static

10

webrat_dropper(3).exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    webrat_dropper(3).exe
  • Size 12.8MB
  • Sample261027-2xvnaaxtex
  • SHA256 a10e3538f9ffa54019637f4b19749aa6fed4cea4fa487c1d4822d188d1d4e894
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
salatstealerdefense_evasiondiscoveryexecutionpersistencestealer

Malware Config

Targets

    • Target
      webrat_dropper(3).exe
    • Size 12.8MB
    • SHA256 a10e3538f9ffa54019637f4b19749aa6fed4cea4fa487c1d4822d188d1d4e894
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionsalatstealerpersistencestealer

    • Detect SalatStealer payload

    • Family: salatstealer

      SalatStealer is a stealer that takes sceenshot written in Golang.

      stealersalatstealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Executes dropped EXE

    • Uses WMI to collect hardware manufacturer information

      Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks