Malicious
PE Executable
MD5: 1db8bde0b0a86af0bb94d2b7328b65d1
Size: 3.59 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 3.4 MB PE Executable identified by Malva.RE as Salat Stealer (stealer). Static analysis extracted 1 embedded or derived file, a malware configuration (Salat Stealer configuration (partial)) and 5 command-and-control endpoints. It matches 3 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab
- MD5
- 1db8bde0b0a86af0bb94d2b7328b65d1
- Verdict
- Malicious
- File type
- PE Executable · 3.4 MB
- Family
- Salat Stealer
- Category
- Stealer
- C2 (defanged)
hxxps://salator[.]es/sa1at/hxxps://wruser[.]org/sa1at/hxxps://websalat[.]top/sa1at/hxxps://sa1atik[.]cn/sa1at/hxxps://wruser[.]org:992/sa1at/
Cite this report: https://app.malva.re/sha256/4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab
Related Salat Stealer samples
- 33429ed0b3bb1265163836e69a0796f62cbe39f4ef00a34c7b9a6489e944cf34 2026-11-01
- a1360df25b0268909ddb1c851fbc51b9ef8c3bcdf65a735c14523d1a02fc06c7 2026-11-01
- 1e47db779a486ffad0b5b7ea6b7be5a9598d22d0d4b4df0541003ea744f5d47c 2026-11-01
- cd9c972e46b2cf283be8227c67417a4c5bb2009fc91a14b0845f20d86e2a0067 2026-11-01
- f42ef68f6591f4e75d25321d5a28b4c92b3363e68277ecd7bd9cc97f3d13279b 2026-11-01
- 8def187287dfd6bcf6111a4fbcf513aa3bab103200b55977c6879437dbc25071 2026-11-01
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
3.59 MB · 3,592,192 B
First seen
2026-11-01 11:30 · 2 hours ago
Last seen
2026-11-01 11:30 · 2 hours ago
Last analysis
2026-11-01 11:30 · 2 hours ago
Hashes
MD5
1db8bde0b0a86af0bb94d2b7328b65d1
Sha1
dc3b307b11b3a31317a3efb33288e6384c0db648
Sha256
4de2ee5e21f844d41b0cdd4e2d6e869a5f3ffbbb975cad3f29b567db50f007ab
Sha384
9c47f74f87ffd8a6cf5ecaf57b421bfd93b19fdb2c3b7e06b47981c463c351a0328769a8ede2a53d293d0d2c0c4894ba
Sha512
db5770bc7e20b591533a42f42ca98bfe59ebefe63cf64fcfbb30f9b93b52e21cdef2a6831e66b906513502cf622bd0b745bf0d425e771b53697c07f199318ce8
SSDeep
49152:XhQpSxBpRkqX+ZdoYq6FVJrhD1ml0TG25+Ce7V5ZNAmZFaYjhBJtM2Z1Eb0Knw9n:XGpSzZYfL1ak1+Cetyej3Jtt/5Kv
TLSH
81F5330559BAC002EF733F371139DDBF85A243DBEBA22A46F3358B31C56915F824166A
Detection
PeID
Microsoft Visual C++ v6.0 DLLUPX -> www.upx.sourceforge.netUPX 2.93 - 3.95 (LZMA) ASL sign UPX 3.02UPX v3.0UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser
2 malicious · 2 files
EXE1db8bde0b0a86af0bb94d2b7328b65d1Salat Stealer
Structure
EXE[UPX unpacked Lzma].exeSalat Stealer
Structure
BINSalat Stealer
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe
Shape
pe:exe
malicious
1 nodes
| Config. Field | Value |
|---|---|
| Extraction status | pahuhuhuhu |
| Configuration complete | Fhuhuhuhu |
| Authenticated startup values | 5huhuhuhu |
| Recovered configuration XOR key | d0af20huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus [recovered] | cc03d7huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus role | Decodehuhuhuhuhuhuhuhuhuhuhu |
| Key derivation seed [recovered] | bhuhuhuhu |
| Key derivation seed role | Statichuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 1 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 1 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 2 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 2 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 4 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 4 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver account [recovered] | Ef_lZ1huhuhuhuhuhuhuhuhuhuhu |
| TON resolver account role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL [recovered] | https:huhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL role | TON rehuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| UPX | UPX method: Lzma, filter: X86CallJumpBe |
| UPX | |
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential