salatstealer | webrat[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
webrat.zip
Size 3.0MB
Sample261030-b91rysda47
SHA256 1ff00baf4a0329fd9a38aff8c74a5597868e9f5aa2ba22ed32682e308422e917
MD5 6301eb4c1a17297e98a0bac33c8e682b
SHA1 157b7c6b6c23c927c418ec06de44d739e614ab20
SHA512 a3d609b7537bd671cea9f44036994c07b58d7a4bb7f28f3c04763b738743d894a0a169289558f101c6d7170bb792583ec8a75d3d896acb763c947d5d6bbaf9f7
SSDEEP 49152:7q/4k+YWPUjrEcNLlk0Qsm6DDEXnFE+sRRB88daYNggorMGBiDZhiO87FUu2oQmY:7qwk+YWcjrTQsm6D4XnoRB884YmhQGBG
TLSH
T1A1E533DE54A1FF474102D23E6E12521AFB3D2F5C335A263623972B64ED5BCA68C3611C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer salatstealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
static1/unpack001/webrat.exe	family_salatstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/webrat.exe

File Explorer

webrat.zip

.zip 3.0MB
webrat.exe

.exe 7.2MB

webrat.zip

SHA256 1ff00baf4a0329fd9a38aff8c74a5597868e9f5aa2ba22ed32682e308422e917
MD5 6301eb4c1a17297e98a0bac33c8e682b
SHA1 157b7c6b6c23c927c418ec06de44d739e614ab20
SHA512 a3d609b7537bd671cea9f44036994c07b58d7a4bb7f28f3c04763b738743d894a0a169289558f101c6d7170bb792583ec8a75d3d896acb763c947d5d6bbaf9f7
SSDEEP 49152:7q/4k+YWPUjrEcNLlk0Qsm6DDEXnFE+sRRB88daYNggorMGBiDZhiO87FUu2oQmY:7qwk+YWcjrTQsm6D4XnoRB884YmhQGBG
TLSH
T1A1E533DE54A1FF474102D23E6E12521AFB3D2F5C335A263623972B64ED5BCA68C3611C
MD5 SHA1 SHA512 SSDEEP TLSH

webrat.exe

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 2c496e41d45ee787edef9c8dec4fe59e68a0d99746c899a6aabc6cbb36419bd6
MD5 ccbeecc96f564e1a1dfbaf7e7fdf884b
SHA1 b8a5697b4eb41405a191c084087d42ab2ab0337e
SHA512 8ab7f2968b247fe699e396d70b7b20ce6fe4554721f34c6398acfb7a99d09c346603184e56fa9c32d2215adbd3ece25d85442f4246fddfdb05aab092a8b430bc
SSDEEP 98304:9d69ZCHQrM5ViBfDXBUizumvBh8huT7Eqfd:98ivYfziDql
TLSH
T1C176390BFCA519E8C1AED1358AA6D1537F717C895B2123E31B90F6282F36BD06DB9344
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect SalatStealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

556480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

417KB

Virtual Size

32.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

webrat.zip

webrat.exe

kernel32

generic