Malicious
PE Executable
MD5: 264ff422002304287f1784c8829adc62
Size: 3.59 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 3.4 MB PE Executable identified by Malva.RE as Salat Stealer (stealer). Static analysis extracted 2 embedded or derived files, a malware configuration (Salat Stealer configuration (partial)) and 5 command-and-control endpoints. It matches 3 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 9d2be61bc0fa04a480ce57afe4da5e8cf9bd7d27ed3847c9d3b2b143d530240f
- MD5
- 264ff422002304287f1784c8829adc62
- Verdict
- Malicious
- File type
- PE Executable · 3.4 MB
- Family
- Salat Stealer
- Category
- Stealer
- C2 (defanged)
hxxps://salator[.]es/sa1at/hxxps://wruser[.]org/sa1at/hxxps://websalat[.]top/sa1at/hxxps://sa1atik[.]cn/sa1at/hxxps://wruser[.]org:992/sa1at/
Cite this report: https://app.malva.re/sha256/9d2be61bc0fa04a480ce57afe4da5e8cf9bd7d27ed3847c9d3b2b143d530240f
Related Salat Stealer samples
- 21aa6f23743de09ac67dac0bd7767244e674760b5d82d22d744147222ad6cf28 2026-10-31
- 3fe04b42445dd4e08735c7bca2b091f14272fc7c25043231a209846990c53aac 2026-10-31
- 1864be0b69e60285e2605bb31b13f69c30324d741feedabdbefcfe0e25226910 2026-10-31
- 16af7c8b76e9ad83ccdce30f149ea399ce28cb2d56b2b013d4e31fcdeaaa2908 2026-10-31
- 2c28fcab0fb09576842a3b77f5227e878f27f5a1f6f83875c77974d99c439d41 2026-10-31
- 034f7817fab44a5d72f428170f8be4a2faa07e20ede49a4a0908ab05c422a1c1 2026-10-31
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
3.59 MB · 3,592,982 B
First seen
2026-10-26 02:16 · 5 days ago
Last seen
2026-10-26 02:16 · 5 days ago
Last analysis
2026-10-30 14:41 · 21 hours ago
Hashes
MD5
264ff422002304287f1784c8829adc62
Sha1
37bc486ecf720d5ff7eb7337c37f65ee99a54eb7
Sha256
9d2be61bc0fa04a480ce57afe4da5e8cf9bd7d27ed3847c9d3b2b143d530240f
Sha384
d3735b85eeb43485d012e8525bee8bf06e016b841362c8fc7379b8b42d79857bc24c6bc1a12984579418025f9f60ec48
Sha512
6ba583718427800c53ef8c7565fca2eba7c02957710cbfb9b7962511dd951962fe4869eeea7c055afea17215b3c9aa1517a04365043d8b309d30a1fb3d644673
SSDeep
98304:niJ2oaNEfaVbzxGvBkBWZGVLTfh7wpEES4OT:iJiafuIO7rhWEES4I
TLSH
C9F5335BF5AB47B3F7D9A831560FC66458B09FE40A20D38AD4DBAA9F0886FD0C241375
Detection
PeID
Microsoft Visual C++ v6.0 DLLUPX -> www.upx.sourceforge.netUPX 2.93 - 3.95 (LZMA) ASL sign UPX 3.02UPX v3.0UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser
2 malicious · 3 files
EXE264ff422002304287f1784c8829adc62Salat Stealer
Structure
BINOverlay_24d80492.bin
EXE[UPX unpacked Lzma].exeSalat Stealer
Structure
BINSalat Stealer
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>bin
Shape
pe:exe>bin
malicious
2 nodes
| Config. Field | Value |
|---|---|
| Extraction status | pahuhuhuhu |
| Configuration complete | Fhuhuhuhu |
| Authenticated startup values | 5huhuhuhu |
| Recovered configuration XOR key | d0af20huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus [recovered] | cc03d7huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus role | Decodehuhuhuhuhuhuhuhuhuhuhu |
| Key derivation seed [recovered] | bhuhuhuhu |
| Key derivation seed role | Statichuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 1 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 1 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 2 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 2 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 4 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 4 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver account [recovered] | Ef_lZ1huhuhuhuhuhuhuhuhuhuhu |
| TON resolver account role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL [recovered] | https:huhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL role | TON rehuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_24d80492.bin (278 bytes) |
| UPX | UPX method: Lzma, filter: X86CallJumpBe |
| UPX | |
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential