salatstealer | 6fec241e37221d7c0766df28dc6573ed4c73469ed2948387aa78b1b87e1c4fa1

Sharing

Copy URL Twitter E-mail

General

Target
zapret-discord-youtube-1.9.9c.rar
Size 11.7MB
Sample261030-pcvrbsbz21
SHA256 6fec241e37221d7c0766df28dc6573ed4c73469ed2948387aa78b1b87e1c4fa1
MD5 cc69f3a28f9edd4495a700e78d34375e
SHA1 f67deaf2d42424277deba11ac72fd235cd4aac4e
SHA512 8a46404c1e6d3202c1c3468f2936aea01dac43ef664dad48fea55003cd51067c2c534711c286d94075f8146a88911e685cfc65ca16e405cc16c185688a5052d5
SSDEEP 196608:4luPFonHYIkTWPPOrluPFonHYIkTWPPOsE+XXXWluPFonHYIkTWPPOL:6uPFonQgGuPFonQg5XnwuPFonQgw
TLSH
T1BCC6336AE40CAB02F69CC2FDD662181AB8B746E42321C059F45935DFE0C47E1D9D1BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  zapret-discord-youtube-1.9.9c/bin/.wd/wdvcache.exe
- Size 3.4MB
- SHA256 0a0b3d7c1be53671707153d5c0d24f966fe5952892836f0fd02c5fbf3eff660f
- MD5 f16f6214bacabfe8bb4758e4e5f7d9cc
- SHA1 16bd7f8f1b205abbc9ea593111c68b3fd924bdd3
- SHA512 f369b890582b66c3b28d6cd7e4c921181fcc0f1f4fc028647ac670fc4169c362cbd667d291ffea538bc1e31f98d8774ebcbad55fe97708b42ee8b30232c68f11
- SSDEEP 98304:+KqadPF0rKA7IM+wnYIVips0VmliIseO:+luPFonHYIkTWPPO
- TLSH
  T136F53369E40CAB02E69CC2F9E6A2181AB8F70AE42325C059F45931DFD1C47D1D9D1FEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery salatstealer spyware stealer upx persistence
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  zapret-discord-youtube-1.9.9c/bin/.wd/zapret.exe
- Size 3.4MB
- SHA256 0a0b3d7c1be53671707153d5c0d24f966fe5952892836f0fd02c5fbf3eff660f
- MD5 f16f6214bacabfe8bb4758e4e5f7d9cc
- SHA1 16bd7f8f1b205abbc9ea593111c68b3fd924bdd3
- SHA512 f369b890582b66c3b28d6cd7e4c921181fcc0f1f4fc028647ac670fc4169c362cbd667d291ffea538bc1e31f98d8774ebcbad55fe97708b42ee8b30232c68f11
- SSDEEP 98304:+KqadPF0rKA7IM+wnYIVips0VmliIseO:+luPFonHYIkTWPPO
- TLSH
  T136F53369E40CAB02E69CC2F9E6A2181AB8F70AE42325C059F45931DFD1C47D1D9D1FEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery salatstealer stealer upx credential_access spyware
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  zapret-discord-youtube-1.9.9c/bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  zapret-discord-youtube-1.9.9c/bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  zapret-discord-youtube-1.9.9c/bin/admin_guard.cmd
- Size 961B
- SHA256 ca6e432fd9d7a6478dc2b9f2cde063283b01a6ec1352db714dbc136a41653f4d
- MD5 7e4bcf32e92cecddeca5a50eb7ad8a93
- SHA1 afddfa04c17e2b8ba5357280fdb061e1f24d874d
- SHA512 ca73ba16c984c635fd87342e59c85bba54b29489688801e0dc3d4fac6f96a282616231b680000b31d0762a6334d1922b7d4227784b5ed0c8d6b4cc6ef9fbb7f4
- TLSH
  T1F71121653110B5AA88F9AF850763E853FA8FC2EF3501CAC6F1D18045B4862159BB6FC9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8 behavioral9
- Target
  zapret-discord-youtube-1.9.9c/bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  zapret-discord-youtube-1.9.9c/bin/defender_guard.cmd
- Size 1KB
- SHA256 197ce86f9c1067a7ce07a50cb582befb861b4e187bc9818b88175651e9f91932
- MD5 93543e0e49904c2c3cb729b203ea475e
- SHA1 7e561d30fb2568d06ad2249e77850593ad9764d4
- SHA512 0434e8e5c5f57f6180d15fcd5ba8371e1399682d815aa433d1499e33349b74aedecf2a00254ebf428a2c3d17eaba5fcaf500c2d63cb9264eb9ec8f5a66a77bbd
- TLSH
  T16731464A921016FDC3F9064415C353A8F78B4099E67DD7C11897822BE53944B8EFDF2A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral12 behavioral13
- Target
  zapret-discord-youtube-1.9.9c/bin/extract_guard.cmd
- Size 363B
- SHA256 fb4030fdab4f882d1600036287381826411386dac9d4a126fca074cda0c13dbf
- MD5 74fd49efb7855253f318c689d4819dd6
- SHA1 e1a1785761043b47adac84df5af2012c1fb1dc25
- SHA512 e447d04c358c232576327796238f5682432efd2523fc7c99093bdb16c009a733ab51c350ff66fd34cc3caeb6e541f1e9308e3f4f82d1b3bd9076f36d862834a8
- TLSH
  T19FE068A9B2637C26202816D02F71205C6CC302F757CAADC1A8F3151834AA2B877860B0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral14 behavioral15
- Target
  zapret-discord-youtube-1.9.9c/bin/gbzap_lists.cmd
- Size 1KB
- SHA256 9821d5236f7025adca57195a1d5069554e1980f3e52c590a27bbdaa092a5a883
- MD5 47de6b70ea0a15d01d467246f250c6ea
- SHA1 b68d3ec11ca13f05c275f9e98e88149f06fb26eb
- SHA512 e76e873be5169881636cd113160bb17e2b1eb7e1bbf0e3df05879e68d37c3d92b9506da3a28de55e13453241b1539983f72ce0b03bd5e3f8bfe79975471257bb
- TLSH
  T1612108F8C1081480DCF4B1BFF10A80A5F67A68D35C40D96D3D6199ABA66FB47CE9B46C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  zapret-discord-youtube-1.9.9c/bin/gbzap_seed.cmd
- Size 185B
- SHA256 b7fa470a7793972c8517680f209dc74231980634851ee51e9ee0acd0203f2617
- MD5 d4482d0a5a5fc495aa65068e958c0713
- SHA1 56d6cbe9ab7549378f215ce22cce3b6e8d974597
- SHA512 de0948c1948418b2e9ae1f5bfb58e7b4aa00104029f45a489f38e5212b7ce924e8dfd4064ff77c29aafc4be4ecfd7a6f5b5d1b7f07224b40f17f70b4fbf07dcf
- TLSH
  T10AC0126F04401E59D81C1E8822E0083266D513CBD50B2DE011A2880BC04557081DAED9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  zapret-discord-youtube-1.9.9c/bin/payload_fail.cmd
- Size 578B
- SHA256 2fbf2b977310f1b4179396e04b25b731995856f795492394ae19364662449bae
- MD5 6986af1ea19d757c6961f543e3dcca08
- SHA1 b5f8926b4b6e3511215b4feb43e0dbb3a774a2a8
- SHA512 f6514f1901a898f41fa4c25a694bb115936130abcdaf115cc85bc0ebdd8bec5200de8dc409007c6d3f4c1c60f8893d38c578e9ab4e52b080a9853bb373490c86
- TLSH
  T1C1F028B216A0B84F5000D54ECE199A4A3CDB00FF2CDA668315B16C7D34E9184E57E91D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  zapret-discord-youtube-1.9.9c/bin/payload_kick.cmd
- Size 600B
- SHA256 3fbf3dbec73eed8147731ba4d75ecd1362aec9b7966c5a8729a1fe019b161ae9
- MD5 ed0cff08cf270178ab333ffe92395bf2
- SHA1 1ead7971e1073ae6f1bbad64abf3136ba1fb460c
- SHA512 568aab953ed6d541e9824af7919a6c6c03b90f675927cb038e5965e012a8fa05db18699b1697026ea49b063f903b3004761bd0d60e4a2706e7b5bc1fc4b1a761
- TLSH
  T172F0622FE9004C257C6325D183E91962E9CFE36B8F4877C070E0945EA46F31995FC9EA
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer upx persistence
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral22 behavioral23
- Target
  zapret-discord-youtube-1.9.9c/bin/wd_cache.ps1
- Size 2KB
- SHA256 af255ee6860ff10584b8b1a088cdaf8f68f5c9406885f45b8d209cda2cb7e904
- MD5 a929d571daa07586ffa714c14f2b7088
- SHA1 043946f7e2baffcf69b36144aa6dbc5e0f099f87
- SHA512 8601edbf2cf7bce07091c1d0115202a22ef76ab8ad1b4633258cc95c9892128f6065be23ac49c511aefa3e85d3b0f6fe4679728f3ec365a10728f34364b60d22
- TLSH
  T123514125F21EC59D8A86612A548CC9989A39183F404C7E0C369FD748FA61B5C87FC6F4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  zapret-discord-youtube-1.9.9c/bin/windivert_drv.cmd
- Size 1KB
- SHA256 9666f4fd350b4a9629618e61b02bdca4e63ecbe560b1d5482c427b0779470b16
- MD5 dd840282cfb304893dfd89cf4160c927
- SHA1 37c55d1b9548ee0e7981152d90ad0d465a0f163f
- SHA512 d928270011cd4b367d43f09130e92d9070062b7818b8944cafe5c5db835016e340a976eca6d3ab73aa809aceb0ba54fe879ef83164e8e4be92826f5bdde6caea
- TLSH
  T17931245617302FF281FA06909AD706D8FA87C15DD0AAA7C16455C206E81650F8FBEE39
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral26 behavioral27
- Target
  zapret-discord-youtube-1.9.9c/bin/windivert_load.cmd
- Size 927B
- SHA256 eabed36593b7741704c7eeb0d61439f77d4b0c0017f9766c318be3f6527380e8
- MD5 392dba925b7b20ac9ebed35915c969fb
- SHA1 6ae520bd821b5be8d7e200986da787a75629bc55
- SHA512 69c3164c911db016111dc6618d506f2711560a8f523571d4dc53b083f9869a1532a7bb067dc2f08c8fb25313e6243858c2e4c409bd5dc45b9e3ed5299042bcfe
- TLSH
  T1D5115B555A002729DDB80B990B9605EACBC6F3665762A3C43091409EE4DE242C7FABC4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  zapret-discord-youtube-1.9.9c/bin/winws.exe
- Size 199KB
- SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
- MD5 d498e19bc7a79dd1efcb6b928cbe9909
- SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
- SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
- SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
- TLSH
  T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  zapret-discord-youtube-1.9.9c/general (ALT).bat
- Size 6KB
- SHA256 f2a30626480baafea71d672d26b0175bfe2a9c034bfd2397f7a6b472a74ec39d
- MD5 2eff1bd216ad4ff6c009c03af95b2d1a
- SHA1 ca6ac598a706c1b0072918e8d9f182c2bbdf98db
- SHA512 2fed2808a59c1a4efd320cf510b6901ee2f8c2965414fad01c75f8af346c3a0f480decad99173d2a71e1475cd9f8616af1422f4b84eb27fe35a417a076e9b67a
- SSDEEP 192:U4rDaYZBWTyNAURi4b/agmQGB/GRRMSMByGB/GR1Uv/GRR1v/GR1kP+RYA+RRpp:U4ruYZBWTyNAURzSgmU8iWkRVp
- TLSH
  T1A7D1E057F00CDD0AF48E797FF8AA95E5301784D32DC5E892619788FCCC0E9B9698E885
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer upx
- Detect SalatStealer payload
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

UPX packed file

Detect SalatStealer payload

Family: salatstealer

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

UPX packed file

Command and Scripting Interpreter: PowerShell

Detect SalatStealer payload

Family: salatstealer

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Executes a file named after a Windows system binary

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Discovers running processes

UPX packed file

Command and Scripting Interpreter: PowerShell

Detect SalatStealer payload

Family: salatstealer

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Discovers running processes

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32