salatstealer | 8ce20cb34585110ef8c0c9a12a7fa4201a72a1b4e551d42579cda1ed2f9f1be9

Sharing

Copy URL Twitter E-mail

General

Target
zapret-discord-youtube-1.9.9d.2.rar
Size 12.6MB
Sample261030-afyvtstyfw
SHA256 8ce20cb34585110ef8c0c9a12a7fa4201a72a1b4e551d42579cda1ed2f9f1be9
MD5 69dd9474f38a28e045234a912c4db6d6
SHA1 33871d0b1883f4f91900172b794f98b5a2b32eab
SHA512 b8de955bdbb9b5e32de4920f626ae8a4c768e560af87b4242995ab79873bd155d8ab4a35045048b025b815231f774b8607ec1acb417d3da341cd2b6222be22d1
SSDEEP 196608:rO1Ltv3anc+ltvrLOx0J71a0ksF/+TxlLCYACNpGJsrLqujpJ7PZQWMo3m2D38j+:rgLdqnc+/VJ71nksF+32iSSauVflM6
TLSH
T13DD6339CB65A5EAADB62BD37E35C830E61D37B04601CD45A5A48930CCA50E9F4BCC37D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  DiscordFix.exe
- Size 3.4MB
- SHA256 0c8d889bba69756ab0b1d8daedecda4eee20f8dff4d0f69eeecae459f555435a
- MD5 fdb373f598c5540138418fc9de0e3608
- SHA1 94a093864479f37bb609e7d28d73cc4903dd59ef
- SHA512 fe92cdfa3b4bf9a5aa4d1fa673313970c221b36aae323228afad7963be1bfc3d63fdb9162c7ef5707561506c8490a5c6e3b66b888ad5fbb00445cf49fc14a5f0
- SSDEEP 98304:DtJpQJujpJXVrFcWPZQWM83h9m2D38MyKe3od:DLqujpJ7PZQWMo3m2D38jV
- TLSH
  T106F53356F8E16BE7C336651963AC8A09710EEB0C62ACC0D45389D34DC775E59EBCC0EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery salatstealer stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  bin/winws.exe
- Size 199KB
- SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
- MD5 d498e19bc7a79dd1efcb6b928cbe9909
- SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
- SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
- SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
- TLSH
  T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  general (ALT).bat
- Size 3KB
- SHA256 c6dff44ea3c7159788077e31a8e35929eab1c0270fb86f5490d44b1fd049a6fc
- MD5 cadb63e600829d6d26aaac973d55d89d
- SHA1 c737ce586f9c4cc9d68abc62ed9a149f68d5b4c6
- SHA512 f9cfbb955e914dd9e1dfdf75d7cca4973bcf81e1dbeebb833e8e247cfea88b571878c8e80a638021234a1034e74ff9451c060c85b03a95d91d488011ef297738
- TLSH
  T194715DA7E00CDE47F5CDA53EF85FA6A420279C8329D6D452835B89F8CC4EDBD684E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution salatstealer stealer
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral10 behavioral11
- Target
  general (ALT10).bat
- Size 3KB
- SHA256 7a8b4d861c4448ee3fb4aef61d79bcdbfc3ea0ab043145f643539fbd177c8864
- MD5 9a77b713dc626138ec7421f560716a28
- SHA1 06281de584a2f7a10b7d2fbd594f518efd7e4c9c
- SHA512 6e29b0880be24c85c9398fa21b88453b650a0f09045cc7701bba910aa74118e9f179da85b4db53e19b79ad9cfd524916583f7ac83e02c254a955f9ce8bec2c75
- TLSH
  T130712C93E00DDE47F48DA97EF85FA5B52027D88368D6D452439B89E8CC0ECBE684E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution salatstealer stealer
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral12 behavioral13
- Target
  general (ALT11).bat
- Size 4KB
- SHA256 8df459fc47b6becbfd4cc54263ab99ee275a62c8a8097fb4abea236e29e7cc85
- MD5 81d21053303452399da6b09313cac0b3
- SHA1 f4ab94b0bcbb1e29e6f301f1e30772d64608c0a7
- SHA512 e44157ba880e11d3e0688856213e2ff3892ce47ce1013ff38c55a3dc0c376971804d777129fa823511672857905c0981ad856fbfb2cf7cc2b5161af95474826d
- SSDEEP 96:nL67mQGB/GRRQ1z/IKdUGB/GR6Vv/GRRQuv/GR65P+RJ5+RRLxD:AmQGB/GRRGgVGB/GRKv/GRRDv/GRuP+M
- TLSH
  T125914BA3E00DEE46F6CE757EF85FF6A52017C8C328D6D452435B89E8CC0EDB9595A084
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution salatstealer stealer
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral14 behavioral15
- Target
  general (ALT12).bat
- Size 3KB
- SHA256 3f28b3788373c4963ba7b4e38112ae965fef2c99a812f023e9d2c736e99cb9c7
- MD5 707e7f6492429b89d52a665cb47d2e1f
- SHA1 5ce1c89efeda8a2bbf3419d1a7169cdfd08fae23
- SHA512 7c85dacf2a739dbe585b3dbea34354da8cfc49c10975f1215ed8bc03baa6fb6f3c57483f8926fd24a104133e90a275c8a5f51f808ee7d9007fa61b08edf847c2
- TLSH
  T1C0816CA3E00DEE46F6CE757EF85FE6A52017C8C328D6D452435B89E8CC0EDB9594E085
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
behavioral16 behavioral17
- Target
  general (ALT2).bat
- Size 3KB
- SHA256 94a8ef4dc67c5e04100c404604883cee6a7d8ad5d324395ecd71dc8ccb805d80
- MD5 802a10c9f71f69ebe61eeae7693ba0e5
- SHA1 8548aca5802a54f0bceaac04a6c22767de76f86c
- SHA512 a37d97055d38a04e4eef3853cdc7519f1b79cb01a63ccf66fe9558ae678da98e696443cba44847bc28ba08eb15f894b4f8b4fad470a93d0e345004a5ddcf48c5
- TLSH
  T1D5613957E00DDE4AB68EB83FF89EE5E52017C4C31CD6D452439B89E8C84EDBE494E485
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution salatstealer stealer
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral18 behavioral19
- Target
  general (ALT3).bat
- Size 3KB
- SHA256 99c06ea66bdade72d43febbf4e5bd6208351ebd471fa99a39a92253e21526c05
- MD5 aa4abe5d986341f92ed5529c58002d5c
- SHA1 1d369c8ccbadfdf69d47f27aef30159b7f022243
- SHA512 6a67fd0193098890cdba4c0c6a51114eb7f10158d57f078c516a7a303bbff516ef73c7c478c9103d29c7d39b7168f7c26e4980c6389c4639d21583ec5fa86681
- TLSH
  T1AA719E93E00DDE07F4CD6C3EF84FA6B5201788872CD6C851539B49E8C84EDBA6D4B085
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution salatstealer stealer
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral20 behavioral21
- Target
  general (ALT4).bat
- Size 3KB
- SHA256 feee3e7ecdbf3a5a46109b6018144954d793143ad4c889f3273f8ec1e8ac067d
- MD5 1a9353401fc545311572880d32a88f78
- SHA1 9e005a4a276e9b93f0499bdea7aeae070048d31e
- SHA512 86b79c6aa9cda652549cfce001c82eda023e32ddecfdd33d11decbb5afbe9b24fc5eafa5673fa1019a4caddd9ff32855cc6b78753769283f2ad96ebf0d8d44c5
- TLSH
  T1EE715A93E00CDE42F6CDA53EF86FA6A421279CC318D6D452439B89F8DC0ECBD584E594
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
behavioral22 behavioral23
- Target
  general (ALT5).bat
- Size 2KB
- SHA256 3e0a7026cccc02e6ca968dcd3efe4db94181cea190cecf4ac3e7e60d39d4dbb1
- MD5 2d3d8bfe1a53bd8e0d03b8339fc02546
- SHA1 9c02f16df41e3b7510209f21910331a7c3ca298f
- SHA512 7a00daae8665d3d61134e111bb61a88edc657a09744f15fbf4846580d3e5f156e5ff9ac2fbff31327004a8593f581eaeb14f67a36412a8a22017f4284347ba51
- TLSH
  T15D413987F00DDE46B08DA87EFC5AA6F5601BD8C35DE1D452539788E4C84EDAE8C4E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution salatstealer stealer
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral24 behavioral25
- Target
  general (ALT6).bat
- Size 3KB
- SHA256 8ef1e5f6ae38a7a288ba1516293eda9183d7f265210897399f911d8a1e7e62fe
- MD5 e6973238d03286140e2469f9616c9edc
- SHA1 a01e8061bfc7cb2b93aca815ebcd85bc46145ed7
- SHA512 28f8aacc46144648af1d03ede61d4983ee0942469526c49d86c633b63b52b2aeb80ab57b459775ac2b0ef975d1d822907b93171c4999952aecc934a98022d06a
- TLSH
  T144612753E00DDE4AB68FB83FF85EA6E52017C8C35CD6D452539B89E8C84FDBA494E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
behavioral26 behavioral27
- Target
  general (ALT7).bat
- Size 3KB
- SHA256 26b4dd29e5020066660230cf5ea61693dd85b69d15fc11ac967f3adf54fb352f
- MD5 a8efa3ed6068b339fd86951c80e84c2f
- SHA1 19b7620ecab1c14492f9576defcecadb6589edf5
- SHA512 3aba9edd1a5369486b647d60c003bf098d9d45decc76c9a251543934e5ceaae3966c52d6af562a6c733177212d7c5e32534dcd8207d1e1975a8cadaacf3f3f8d
- TLSH
  T1CD513793F00DDE46B68EA83EFC9AA5F52017C8C35CD6D462539789E8C84EDBE4D4E484
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
behavioral28 behavioral29
- Target
  general (ALT8).bat
- Size 3KB
- SHA256 8612e0b0d5eb757448c4d2ef255abc00ff30f2b7e9087e0c936f7ba479af07e5
- MD5 a2865133b7b6bc0adcc51acb7d64ae20
- SHA1 5ccf2ac6e98ef57e60adaef840104f94035f776a
- SHA512 e0f5aaf76637c1a1934a1eba13e35f6cae87c83741ae26b594ee7ef9e9d1b894f75224992b67f82e48577d009187a2152e0475faedec4a7a0b1410bfd3d06329
- TLSH
  T162616A93E00CDE46B58CA83EF85FA6B42127DCC32CD2D452539B88F8D84EDBE584E584
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution salatstealer stealer
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral30 behavioral31
- Target
  general (ALT9).bat
- Size 3KB
- SHA256 4b8f50bd2b5cd71c0a883461d4a526a2cd9494a87847907807d06c233166c2c9
- MD5 4d6ced8c4790b06aba64d176a2ba5e9a
- SHA1 4ea98386b069cc339e301da4ce8c777a81fb0111
- SHA512 71a6234afd9e08d6999d90b765bba7781063a8e76fee8e8793be0a17b31e4bcea4342da6e4eefd4e7e42ce1edf39d9c1c58120af79e56b45d8337ec8b082c099
- TLSH
  T170616A93E00DDF46B48D6C7EF89BA5B52017C8872CD6D852539789F8C44EDAE5C4F085
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Drops file in System32 directory
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Deobfuscate/Decode Files or Information

T1140

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Deobfuscate/Decode Files or Information

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Deobfuscate/Decode Files or Information

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Deobfuscate/Decode Files or Information

Detect SalatStealer payload

Family: salatstealer

UAC bypass

Badlisted process makes network request

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Deobfuscate/Decode Files or Information

Drops file in System32 directory

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Deobfuscate/Decode Files or Information

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Deobfuscate/Decode Files or Information

Detect SalatStealer payload

Family: salatstealer

UAC bypass

Badlisted process makes network request

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Deobfuscate/Decode Files or Information

Drops file in System32 directory

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Deobfuscate/Decode Files or Information

Detect SalatStealer payload

Family: salatstealer

UAC bypass

Badlisted process makes network request

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Deobfuscate/Decode Files or Information

Drops file in System32 directory

Detect SalatStealer payload

Family: salatstealer

UAC bypass

Badlisted process makes network request

Executes a file named after a Windows system binary

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Deobfuscate/Decode Files or Information

Drops file in System32 directory

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Deobfuscate/Decode Files or Information

Detect SalatStealer payload

Family: salatstealer

UAC bypass