Malicious
PE Executable
MD5: 1ca4e7f687891a67b2017438d0ccb470
Size: 3.59 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 3.4 MB PE Executable identified by Malva.RE as Salat Stealer (stealer). Static analysis extracted 2 embedded or derived files, a malware configuration (Salat Stealer configuration (partial)) and 5 command-and-control endpoints. It matches 3 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 3ddcde297d71f9a475a57c2eeb2c923ca22b0fc9f67a1e1664c5057ba326d374
- MD5
- 1ca4e7f687891a67b2017438d0ccb470
- Verdict
- Malicious
- File type
- PE Executable · 3.4 MB
- Family
- Salat Stealer
- Category
- Stealer
- C2 (defanged)
hxxps://salator[.]es/sa1at/hxxps://wruser[.]org/sa1at/hxxps://websalat[.]top/sa1at/hxxps://sa1atik[.]cn/sa1at/hxxps://wruser[.]org:992/sa1at/
Cite this report: https://app.malva.re/sha256/3ddcde297d71f9a475a57c2eeb2c923ca22b0fc9f67a1e1664c5057ba326d374
Related Salat Stealer samples
- fc5eeacaf8c5453827a864a4895628118c9f08df780f3f961a592152b3ca0137 2026-10-30
- a0150547114a3b5d48728afe684c983aa4fe4cb950f791cb120b2256ba39847d 2026-10-30
- 8c91176f087712bbccd91da72609b12d420cf4168c70d5d45a89d0eb3b26c524 2026-10-30
- bfc44506e787628c110b995f00dd77402431f60b24d493b08bb8e875f451abfe 2026-10-30
- 2ab8b874cee325250edfd24c8869efbe8c2ad5285eafc5c4b9f50c16fc76f74a 2026-10-30
- 0f0782cea01c7b6a441590c915cbc2bd926a57d47284851f14078de271f49bcf 2026-10-30
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
3.59 MB · 3,592,942 B
First seen
2026-10-29 00:45 · yesterday
Last seen
2026-10-29 00:45 · yesterday
Last analysis
2026-10-29 14:03 · 12 hours ago
Hashes
MD5
1ca4e7f687891a67b2017438d0ccb470
Sha1
c4b9bf681173bac95bbefb69b41feb73b6e2cf6e
Sha256
3ddcde297d71f9a475a57c2eeb2c923ca22b0fc9f67a1e1664c5057ba326d374
Sha384
25ba5d162cf11de86a445d6022e3c5934d0adb1bb4fabe659f80d477300cb5f26780ac79ab5224012fdd97fd870dd183
Sha512
82329ef2ac003bea5a9c1f98a21e7d54cb73fabd8ad2c82acb12ed1a1f1c853c875486c55d3e523d5aa9f47247113226e8a6c4d56bc487c9d6e9d1b2efa20b12
SSDeep
98304:niJ2oaNEfaVbzxGvBkBWZGVLTfh7wpEES4OH:iJiafuIO7rhWEES4w
TLSH
30F5335BF1AF47B3F7D9A835560FC66458B09FE40A20D38AD4DBAA9F0886BD0C241375
Detection
PeID
Microsoft Visual C++ v6.0 DLLUPX -> www.upx.sourceforge.netUPX 2.93 - 3.95 (LZMA) ASL sign UPX 3.02UPX v3.0UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser
2 malicious · 3 files
EXE1ca4e7f687891a67b2017438d0ccb470Salat Stealer
Structure
BINOverlay_f4e5cf96.bin
EXE[UPX unpacked Lzma].exeSalat Stealer
Structure
BINSalat Stealer
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>bin
Shape
pe:exe>bin
malicious
2 nodes
| Config. Field | Value |
|---|---|
| Extraction status | pahuhuhuhu |
| Configuration complete | Fhuhuhuhu |
| Authenticated startup values | 5huhuhuhu |
| Recovered configuration XOR key | d0af20huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus [recovered] | cc03d7huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus role | Decodehuhuhuhuhuhuhuhuhuhuhu |
| Key derivation seed [recovered] | bhuhuhuhu |
| Key derivation seed role | Statichuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 1 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 1 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 2 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 2 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 4 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 4 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver account [recovered] | Ef_lZ1huhuhuhuhuhuhuhuhuhuhu |
| TON resolver account role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL [recovered] | https:huhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL role | TON rehuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_f4e5cf96.bin (238 bytes) |
| UPX | UPX method: Lzma, filter: X86CallJumpBe |
| UPX | |
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential