Malicious
4ee1469a4e5cc7443b53c5bdb161f001
PE Executable
MD5: 4ee1469a4e5cc7443b53c5bdb161f001
Size: 3.59 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 3.4 MB PE Executable identified by Malva.RE as Salat Stealer (stealer). Static analysis extracted 1 embedded or derived file, a malware configuration (Salat Stealer configuration (partial)) and 5 command-and-control endpoints. It matches 3 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6
- MD5
- 4ee1469a4e5cc7443b53c5bdb161f001
- Verdict
- Malicious
- File type
- PE Executable · 3.4 MB
- Family
- Salat Stealer
- Category
- Stealer
- C2 (defanged)
hxxps://salator[.]es/sa1at/hxxps://wruser[.]org/sa1at/hxxps://websalat[.]top/sa1at/hxxps://sa1atik[.]cn/sa1at/hxxps://wruser[.]org:992/sa1at/
Cite this report: https://app.malva.re/sha256/28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6
Related Salat Stealer samples
- e592ffa52831ba007879fb83efa97556728ce9f7a04a097a67cbdf858ce873a7 2026-10-31
- 57ce811875c338ba2f30c83655390c5420c5c512d8ae4fc1e73ebbc116f856a8 2026-10-31
- 2c2d3d8feaead37bec50b41c2488aac1b2694e34dfafeb92a72c49533afd13d3 2026-10-31
- 476b8e1966c086eb279f19d828718aa67dd535376eb66bb02eba2fd6f2b0ccf2 2026-10-31
- b101c2c3a989c632b3c74b26630d9188116f57d708df759edde7448209fa1f80 2026-10-31
- 697df858ed930b703860b58e62f1cc65e2cb01aef210e2e931ada5a0dbc6b67d 2026-10-31
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
3.59 MB · 3,593,216 B
First seen
2026-10-31 00:15 · 2 hours ago
Last seen
2026-10-31 00:15 · 2 hours ago
Last analysis
2026-10-31 00:15 · an hour ago
Hashes
MD5
4ee1469a4e5cc7443b53c5bdb161f001
Sha1
4219bc6bdce4e7fc0aa43d7c3e4d81663a8a3455
Sha256
28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6
Sha384
37642628d8d71db64452dcd59369bfcb62230bece39fb5aa94826710a3e5e14624caeb3d5b3fb918df60634bb11f9d9c
Sha512
196b275c1f6596e75ed73bf86928b7fe27423e0d74c367025ee40b1abb9a54077c187ecb79a86b8d6638e6f6e23e70b9836be0e0999ecbeb591356a8edf9d752
SSDeep
49152:rNcNA2zEVXm3mK4n4eZ6qphUS6/ajqmzjARa4IHhKxeT+XgftCzwDFKjvhr2E6yx:rNZk3mK0iqph2wcMnA1X8mwDFir2s
TLSH
CEF533C7332A4A45DA425F3A1DE33EBC6B206A452A3744FFC6915C33E54497F0F2A952
Detection
PeID
Microsoft Visual C++ v6.0 DLLUPX -> www.upx.sourceforge.netUPX 2.93 - 3.95 (LZMA) ASL sign UPX 3.02UPX v3.0UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser
2 malicious · 2 files
EXE4ee1469a4e5cc7443b53c5bdb161f001Salat Stealer
Structure
EXE[UPX unpacked Lzma].exeSalat Stealer
Structure
BINSalat Stealer
BINConfiguration
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe
Shape
pe:exe
malicious
1 nodes
| Config. Field | Value |
|---|---|
| Extraction status | pahuhuhuhu |
| Configuration complete | Fhuhuhuhu |
| Authenticated startup values | 5huhuhuhu |
| Recovered configuration XOR key | d0af20huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus [recovered] | cc03d7huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus role | Decodehuhuhuhuhuhuhuhuhuhuhu |
| Key derivation seed [recovered] | bhuhuhuhu |
| Key derivation seed role | Statichuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 1 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 1 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 2 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 2 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 4 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 4 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver account [recovered] | Ef_lZ1huhuhuhuhuhuhuhuhuhuhu |
| TON resolver account role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL [recovered] | https:huhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL role | TON rehuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| UPX | UPX method: Lzma, filter: X86CallJumpBe |
| UPX | |
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential2 malicious · 2 files
EXE4ee1469a4e5cc7443b53c5bdb161f001Salat Stealer
Structure
EXE[UPX unpacked Lzma].exeSalat Stealer
Structure
BINSalat Stealer
| Config. Field | Value |
|---|---|
| Extraction status | pahuhuhuhu |
| Configuration complete | Fhuhuhuhu |
| Authenticated startup values | 5huhuhuhu |
| Recovered configuration XOR key | d0af20huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus [recovered] | cc03d7huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus role | Decodehuhuhuhuhuhuhuhuhuhuhu |
| Key derivation seed [recovered] | bhuhuhuhu |
| Key derivation seed role | Statichuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 1 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 1 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 2 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 2 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 4 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 4 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver account [recovered] | Ef_lZ1huhuhuhuhuhuhuhuhuhuhu |
| TON resolver account role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL [recovered] | https:huhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL role | TON rehuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialSalat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
4ee1469a4e5cc7443b53c5bdb161f001 › 4ee1469a4e5cc7443b53c5bdb161f001 › [UPX unpacked Lzma].exe
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
4ee1469a4e5cc7443b53c5bdb161f001 › 4ee1469a4e5cc7443b53c5bdb161f001 › [UPX unpacked Lzma].exe
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
4ee1469a4e5cc7443b53c5bdb161f001 › 4ee1469a4e5cc7443b53c5bdb161f001 › [UPX unpacked Lzma].exe
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
4ee1469a4e5cc7443b53c5bdb161f001 › 4ee1469a4e5cc7443b53c5bdb161f001 › [UPX unpacked Lzma].exe
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
4ee1469a4e5cc7443b53c5bdb161f001 › 4ee1469a4e5cc7443b53c5bdb161f001 › [UPX unpacked Lzma].exe
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account