General
- Target zapret-discord-youtube-1.10.3.zip
- Size 4.9MB
- Sample261027-pawkvatwhs
- SHA256 fa60c32ca3587ece86fcca558806a7b82c322068f88dd5310af55e8cb40b941a
Malware Config
Targets
-
- Target zapret-discord-youtube-1.10.3/DiscordFix.exe
- Size 3.4MB
- SHA256 ab4e43a86948ffd778d81c5fc8d8d0b620d7d4cab09f659140715279a3be0da3
Score10/10-
Detect SalatStealer payload
-
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target zapret-discord-youtube-1.10.3/bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
Score1/10 -
- Target zapret-discord-youtube-1.10.3/bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
Score3/10 -
- Target zapret-discord-youtube-1.10.3/bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
Score1/10 -
- Target zapret-discord-youtube-1.10.3/bin/winws.exe
- Size 199KB
- SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
Score1/10 -
- Target zapret-discord-youtube-1.10.3/general (ALT).bat
- Size 3KB
- SHA256 94d40f898fcefe075d54895200c85c264a7d0d0b2842a6825b68ffd5d9c07ab7
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target zapret-discord-youtube-1.10.3/general (ALT10).bat
- Size 3KB
- SHA256 6b41d2813aefd7e9328ed42dad7de18ab8bb1bb72c3ed3a9221a9de34e2eb6db
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target zapret-discord-youtube-1.10.3/general (ALT11).bat
- Size 4KB
- SHA256 a695954558273b5bdec5948a562245d83b9d7c556f1c26315f2a47a33dbd9072
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target zapret-discord-youtube-1.10.3/general (ALT12).bat
- Size 4KB
- SHA256 1f8b883822704207974c6da91f6a31e509569f917dfaa52688fba450e3298e77
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target zapret-discord-youtube-1.10.3/general (ALT13).bat
- Size 3KB
- SHA256 0ef7279f222ced580f002c4073cc431307a368d6a70016489fc09e7a1741b0f8
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target zapret-discord-youtube-1.10.3/general (ALT2).bat
- Size 3KB
- SHA256 f928a447fd312866c02e3a06519537c892424c9133a6ec91ee741664ff17595e
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target zapret-discord-youtube-1.10.3/general (ALT3).bat
- Size 3KB
- SHA256 60a821b459d080568a7463ba349da64ad69e65f831078414765e0eb1d365bb0b
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target zapret-discord-youtube-1.10.3/general (ALT4).bat
- Size 3KB
- SHA256 589e0bfef2bac1c18100d768e40fb593757be44028175be800d8953411007d25
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target zapret-discord-youtube-1.10.3/general (ALT5).bat
- Size 2KB
- SHA256 a81c276ecae34c3c39c5d862bbf1ef841ff04864bd854485178adf5a8121f9f8
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target zapret-discord-youtube-1.10.3/general (ALT6).bat
- Size 3KB
- SHA256 ed7a09a6686191fa8a2bf733b5b4d26fefa45c92b62266e1f94bb56aeffcd079
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target zapret-discord-youtube-1.10.3/general (ALT7).bat
- Size 3KB
- SHA256 57cb714ea0e385ab3cea37543fd9ac7d591142571192217b39a6ce7c04f85f15
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target zapret-discord-youtube-1.10.3/general (ALT8).bat
- Size 3KB
- SHA256 cafefaafde22fbf9316a2abe5fcb916c23cb9a820b39cad95317a2b734486d1b
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3