Malicious
04a98fdf01f1487fd562b8f4fa5a1c00
PE Executable
MD5: 04a98fdf01f1487fd562b8f4fa5a1c00
Size: 3.59 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 3.4 MB PE Executable identified by Malva.RE as Salat Stealer (stealer). Static analysis extracted 2 embedded or derived files, a malware configuration (Salat Stealer configuration (partial)) and 5 command-and-control endpoints. It matches 3 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- a04a8a3490737f3259a856a19ec8b8f818c00608ee75d7a50e68c9a06adff9fb
- MD5
- 04a98fdf01f1487fd562b8f4fa5a1c00
- Verdict
- Malicious
- File type
- PE Executable · 3.4 MB
- Family
- Salat Stealer
- Category
- Stealer
- C2 (defanged)
hxxps://salator[.]es/sa1at/hxxps://wruser[.]org/sa1at/hxxps://websalat[.]top/sa1at/hxxps://sa1atik[.]cn/sa1at/hxxps://wruser[.]org:992/sa1at/
Cite this report: https://app.malva.re/sha256/a04a8a3490737f3259a856a19ec8b8f818c00608ee75d7a50e68c9a06adff9fb
Related Salat Stealer samples
- 94f9e0e25b5dc2030f052367711b292252226931a0d445036e268e62d64b7219 2026-10-30
- c391e69c15e9e3bd89189b47f1a67a450a252ef2920164aa037051bec7f2063b 2026-10-30
- d862602379c07d18b2eb997ff44e8cbfa3be5b8efb821e9688bd62571d82d11d 2026-10-30
- 3ea7caa2de8cd0a33c0b31711d819f03d1a9e8e5581e386103bf6581cba56808 2026-10-30
- 5e9fdcff4955e93df4d629627e5900225e13625415d1849e20c279736538fabb 2026-10-30
- 5a2cc426cc7fb3d34fb718cae0b386c041020d41df774afca25e9364b761d852 2026-10-30
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
3.59 MB · 3,592,873 B
First seen
2026-10-28 02:30 · 2 days ago
Last seen
2026-10-28 02:30 · 2 days ago
Last analysis
2026-10-29 23:06 · 12 hours ago
Hashes
MD5
04a98fdf01f1487fd562b8f4fa5a1c00
Sha1
91df523d0ee734975ec7b669a8c883dd771f94b8
Sha256
a04a8a3490737f3259a856a19ec8b8f818c00608ee75d7a50e68c9a06adff9fb
Sha384
a6f8eb0a46effb8ba87b0cd155b5b110e9f11488c2992a18d5e66f4697eae0d93378a11e475023d4c47cb14863f07ffd
Sha512
0fe05a76ef981149d0903ed18004d6276bc603afbb5b20f103374e9ef940699716438fdfc77a927f4e00f231714ab66a73ab1b93ef4221993b23c2342fa83a3b
SSDeep
98304:niJ2oaNEfaVbzxGvBkBWZGVLTfh7wpEES4O4:iJiafuIO7rhWEES4B
TLSH
C8F5335BF1AB47B3F7D9A871560FC66458B09FE40A20D38AD4DBAADF0886BD0C241375
Detection
PeID
Microsoft Visual C++ v6.0 DLLUPX -> www.upx.sourceforge.netUPX 2.93 - 3.95 (LZMA) ASL sign UPX 3.02UPX v3.0UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser
2 malicious · 3 files
EXE04a98fdf01f1487fd562b8f4fa5a1c00Salat Stealer
Structure
EXE[UPX unpacked Lzma].exeSalat Stealer
Structure
BINSalat Stealer
BINConfiguration
BINOverlay_90d15eb7.bin
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>bin
Shape
pe:exe>bin
malicious
2 nodes
| Config. Field | Value |
|---|---|
| Extraction status | pahuhuhuhu |
| Configuration complete | Fhuhuhuhu |
| Authenticated startup values | 5huhuhuhu |
| Recovered configuration XOR key | d0af20huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus [recovered] | cc03d7huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus role | Decodehuhuhuhuhuhuhuhuhuhuhu |
| Key derivation seed [recovered] | bhuhuhuhu |
| Key derivation seed role | Statichuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 1 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 1 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 2 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 2 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 4 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 4 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver account [recovered] | Ef_lZ1huhuhuhuhuhuhuhuhuhuhu |
| TON resolver account role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL [recovered] | https:huhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL role | TON rehuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| UPX | UPX method: Lzma, filter: X86CallJumpBe |
| UPX | |
| Info | Overlay extracted: Overlay_90d15eb7.bin (169 bytes) |
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential2 malicious · 3 files
EXE04a98fdf01f1487fd562b8f4fa5a1c00Salat Stealer
Structure
EXE[UPX unpacked Lzma].exeSalat Stealer
Structure
BINSalat Stealer
BINOverlay_90d15eb7.bin
| Config. Field | Value |
|---|---|
| Extraction status | pahuhuhuhu |
| Configuration complete | Fhuhuhuhu |
| Authenticated startup values | 5huhuhuhu |
| Recovered configuration XOR key | d0af20huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus [recovered] | cc03d7huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus role | Decodehuhuhuhuhuhuhuhuhuhuhu |
| Key derivation seed [recovered] | bhuhuhuhu |
| Key derivation seed role | Statichuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 1 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 1 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 2 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 2 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 4 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 4 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver account [recovered] | Ef_lZ1huhuhuhuhuhuhuhuhuhuhu |
| TON resolver account role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL [recovered] | https:huhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL role | TON rehuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialSalat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
04a98fdf01f1487fd562b8f4fa5a1c00 › 04a98fdf01f1487fd562b8f4fa5a1c00 › [UPX unpacked Lzma].exe
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
04a98fdf01f1487fd562b8f4fa5a1c00 › 04a98fdf01f1487fd562b8f4fa5a1c00 › [UPX unpacked Lzma].exe
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
04a98fdf01f1487fd562b8f4fa5a1c00 › 04a98fdf01f1487fd562b8f4fa5a1c00 › [UPX unpacked Lzma].exe
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
04a98fdf01f1487fd562b8f4fa5a1c00 › 04a98fdf01f1487fd562b8f4fa5a1c00 › [UPX unpacked Lzma].exe
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
04a98fdf01f1487fd562b8f4fa5a1c00 › 04a98fdf01f1487fd562b8f4fa5a1c00 › [UPX unpacked Lzma].exe
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account