salatstealer | 6b5603d0004f059b8fb38500fb1d47286a87d7e97c601b856441183aad14760c

General

Target
Nursultan CRACK Forever.rar
Size 17.7MB
Sample261030-p189mact5s
SHA256 6b5603d0004f059b8fb38500fb1d47286a87d7e97c601b856441183aad14760c
MD5 179f2c43ac083f1d7b647f6bee36ba2f
SHA1 481055b60a58408e5cc26dcb04cf5ad9aa2e1d11
SHA512 21120c5cbc27c2579dba3fb6d5ad543dd59e8c3bdb44beed80de3ffba9a83264248bb101406796d0fd48e3c7d666b22a808d4a343fc1621771f59edcc9ac9586
SSDEEP 393216:OxNiNyjz2vkeLmGw2m2Cunpti32UPoojs3IfW6PcCHmnBdG:gj6CgC2zoY3IfpRmnBdG
TLSH
T1CD173351BA67099ADB36E38F0DC1C343F0EA510FA3BA673D7435A49F7442D793021A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Nursultan CRACK Forever/NurikBypasser.exe
- Size 3.4MB
- SHA256 ebc22d0c86d5c1d3dd713368cf5ee5b231e8cd74b437018715706e1a9b3a2764
- MD5 6a56ff0a98bfe486b1bf9076be377366
- SHA1 f5cb52fce9d712c5e56ad485131c4edca169301d
- SHA512 b1aab18c8d01d8855516ab3774a69e805576850021d32a4643cb2eed28cfd46987aebc3848e3d356b70715f1e13222feb1391de761d232e389846b8c4d672e89
- SSDEEP 49152:0LLzhDK613wGxvfKSYqZSyKP3bXfGGjNjymzvuB+TKqxu569uYKN0Z81x:0ThuM3lx3K9qZSBvbuwzvE+H4Gu881x
- TLSH
  T13EF53305980F0EEDF92F4DF3E5F67B2110B6CA4B4B93B43F000A5A01B6C952D96E759A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery salatstealer persistence spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  Nursultan CRACK Forever/Nursultan.exe
- Size 15.8MB
- SHA256 28a26cfeb59075825d9ed5308c048f5727251f9d8032e2cb741744f151a32730
- MD5 f093bfdddaebec4a4fd0512538f85eb5
- SHA1 73322ec73005d374c7ec984f39576ab4e8cfc6d3
- SHA512 4beaa85c7ab82cf8ce5e3434b0738efd9e75a0b24948e5f2bf2d3ca05c952201db9e4ac00d84c84a6d00ab96f0c18bd70b53b35322007022deaaa48f7cedc820
- SSDEEP 393216:0KaFvN74hqFkojMIColXKchAa2N+idjK9h4Pd:0bFNkha3INolKBREed
- TLSH
  T1EBF6228125D5C6FCC48687F8E24615F9F0D37C8899FDD41BEF87A422FA31928C8E5626
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery salatstealer persistence spyware stealer trojan upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- UAC bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2