Detect SalatStealer payload

Family: salatstealer

SalatStealer is a stealer that takes sceenshot written in Golang.

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Enumerates VirtualBox DLL files

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VirtualBox drivers on disk

UPX dump on OEP (original entry point)

Looks for VMWare Tools registry key

Looks for VMWare drivers on disk

Looks for VMWare services registry key.