Malicious
PE Executable
MD5: 4b0a1f2052ba038fbb9af97697e15394
Size: 3.59 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 3.4 MB PE Executable identified by Malva.RE as Salat Stealer (stealer). Static analysis extracted 2 embedded or derived files, a malware configuration (Salat Stealer configuration (partial)) and 5 command-and-control endpoints. It matches 3 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 2aeb071f5cbdd485d6c714e51f0e4e78c4be82f3426f61c835a81259f44922d7
- MD5
- 4b0a1f2052ba038fbb9af97697e15394
- Verdict
- Malicious
- File type
- PE Executable · 3.4 MB
- Family
- Salat Stealer
- Category
- Stealer
- C2 (defanged)
hxxps://salator[.]es/sa1at/hxxps://wruser[.]org/sa1at/hxxps://websalat[.]top/sa1at/hxxps://sa1atik[.]cn/sa1at/hxxps://wruser[.]org:992/sa1at/
Cite this report: https://app.malva.re/sha256/2aeb071f5cbdd485d6c714e51f0e4e78c4be82f3426f61c835a81259f44922d7
Related Salat Stealer samples
- 62588a99e3e0784e08a8bddaae655febd2bcc1fc7bc5affac10f962312f34ca3 2026-11-04
- 2121d89582dcf0c50db21770effabab7e9eabbe241cbba827266323dacf226b8 2026-11-04
- be92c7289664952d3dcd925c64a32fdc82bf7fc0bfd109b8a208d92ad1152850 2026-11-04
- c3931c4bc170bd4acfbb9589fe00be1d42aeabe2f29c52a974fa2fcbe722ad62 2026-11-04
- 73ff867b9084b1728f224aac0a285d824489224b6ef79def8483045ed846fae7 2026-11-04
- 4daac7b0684111d3466b1dbe38e27117b0fb29e65d9dbbf5751b580ac65d7909 2026-11-04
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
3.59 MB · 3,592,990 B
First seen
2026-11-04 02:30 · 2 hours ago
Last seen
2026-11-04 02:30 · 2 hours ago
Last analysis
2026-11-04 02:30 · 2 hours ago
Hashes
MD5
4b0a1f2052ba038fbb9af97697e15394
Sha1
f3f13bf2f98ee066ddd2de8d139b3f1eba2d6ebd
Sha256
2aeb071f5cbdd485d6c714e51f0e4e78c4be82f3426f61c835a81259f44922d7
Sha384
e16b12f1990be77e6348a5edf5fe67a0840b0ba7f6aa8b8d49c5278d7bc802da2296b8fb3a0940136c346cc1d2fa9311
Sha512
5ee3028a22d27d287b33658e7b24ba1a495e5491e122602d6f2cc2d75c4cb20aef9fea531bf53d9e77e8f6e07d4e2fdb1e87ba8ede93751bd871c306815f0f6d
SSDeep
98304:niJ2oaNEfaVbzxGvBkBWZGVLTfh7wpEES4ON:iJiafuIO7rhWEES4K
TLSH
84F5335BF1AF47B3F7D9A871560FC66458B09FE40A20D38AD4DBAA9F0886BD0C241375
Detection
PeID
Microsoft Visual C++ v6.0 DLLUPX -> www.upx.sourceforge.netUPX 2.93 - 3.95 (LZMA) ASL sign UPX 3.02UPX v3.0UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser
2 malicious · 3 files
EXE4b0a1f2052ba038fbb9af97697e15394Salat Stealer
Structure
EXE[UPX unpacked Lzma].exeSalat Stealer
Structure
BINSalat Stealer
BINOverlay_0c187c95.bin
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>bin
Shape
pe:exe>bin
malicious
2 nodes
| Config. Field | Value |
|---|---|
| Extraction status | pahuhuhuhu |
| Configuration complete | Fhuhuhuhu |
| Authenticated startup values | 5huhuhuhu |
| Recovered configuration XOR key | d0af20huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus [recovered] | cc03d7huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus role | Decodehuhuhuhuhuhuhuhuhuhuhu |
| Key derivation seed [recovered] | bhuhuhuhu |
| Key derivation seed role | Statichuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 1 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 1 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 2 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 2 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 4 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 4 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver account [recovered] | Ef_lZ1huhuhuhuhuhuhuhuhuhuhu |
| TON resolver account role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL [recovered] | https:huhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL role | TON rehuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| UPX | UPX method: Lzma, filter: X86CallJumpBe |
| UPX | |
| Info | Overlay extracted: Overlay_0c187c95.bin (286 bytes) |
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential