5aca641bcbef3da1e9bdb93512a00df5

PE Executable

MD5: 5aca641bcbef3da1e9bdb93512a00df5

Size: 12.57 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Salat Stealer (stealer). Static analysis extracted 1 embedded or derived file, a malware configuration (Salat Stealer configuration (partial)) and 5 command-and-control endpoints. It matches 2 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: 9c603c163ae0d173d68393428d1aae5dd24383914b63edb4a0e30f5573d66d35
MD5: 5aca641bcbef3da1e9bdb93512a00df5
Verdict: Malicious
File type: PE Executable · 12 MB
Family: Salat Stealer
Category: Stealer
C2 (defanged): hxxps://salator[.]es/sa1at/hxxps://wruser[.]org/sa1at/hxxps://websalat[.]top/sa1at/hxxps://sa1atik[.]cn/sa1at/hxxps://wruser[.]org:992/sa1at/

Cite this report: https://app.malva.re/sha256/9c603c163ae0d173d68393428d1aae5dd24383914b63edb4a0e30f5573d66d35

Related Salat Stealer samples

3fe04b42445dd4e08735c7bca2b091f14272fc7c25043231a209846990c53aac 2026-10-31
1864be0b69e60285e2605bb31b13f69c30324d741feedabdbefcfe0e25226910 2026-10-31
16af7c8b76e9ad83ccdce30f149ea399ce28cb2d56b2b013d4e31fcdeaaa2908 2026-10-31
2c28fcab0fb09576842a3b77f5227e878f27f5a1f6f83875c77974d99c439d41 2026-10-31
034f7817fab44a5d72f428170f8be4a2faa07e20ede49a4a0908ab05c422a1c1 2026-10-31
93d8e5e8b84f00349042af393b0b8f8bf5de10939029baa103c6eeae5a2df9f0 2026-10-31

All Salat Stealer analyses →

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Size

12.57 MB · 12,570,936 B

First seen

2026-10-31 02:30 · 2 hours ago

Last seen

2026-10-31 02:30 · 2 hours ago

Last analysis

2026-10-31 02:31 · 2 hours ago

Hashes

MD5 5aca641bcbef3da1e9bdb93512a00df5 Sha1 3da11b09750f38a8948cf31bd7d61070069543aa Sha256 9c603c163ae0d173d68393428d1aae5dd24383914b63edb4a0e30f5573d66d35 Sha384 a4ec50b605e15af94bbdf34a67bd51a980bc5f2279cbbd9d28b1fe147734ebd418dbf7459d3818eb9e220212069b9eb8 Sha512 80d90ce019333bc1783bfe2959c34ce9cf8bcda9ceb3a18683d66acb1d1d06a78615d20b29af65b1c7764eb0f148e5b7244f6e37e8408f983044c9086a42d480 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+t:yBkKr5rszpNDy+t TLSH 92C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files

EXE5aca641bcbef3da1e9bdb93512a00df5Salat Stealer

Structure

BINSalat Stealer

BINConfiguration

BINOverlay_5aab2411.bin

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Config. Field	Value
Extraction status	pahuhuhuhu
Configuration complete	Fhuhuhuhu
Authenticated startup values	5huhuhuhu
Recovered configuration XOR key	d0af20huhuhuhuhuhuhuhuhuhuhu
RSA modulus [recovered]	cc03d7huhuhuhuhuhuhuhuhuhuhu
RSA modulus role	Decodehuhuhuhuhuhuhuhuhuhuhu
Key derivation seed [recovered]	bhuhuhuhu
Key derivation seed role	Statichuhuhuhuhuhuhuhuhuhuhu
Startup constant 1 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 1 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 2 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 2 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 3 [authenticated]	https:huhuhuhuhuhuhuhuhuhuhu
Startup constant 3 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 4 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 4 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 5 [authenticated]	https:huhuhuhuhuhuhuhuhuhuhu
Startup constant 5 role	Confighuhuhuhuhuhuhuhuhuhuhu
TON resolver account [recovered]	Ef_lZ1huhuhuhuhuhuhuhuhuhuhu
TON resolver account role	Confighuhuhuhuhuhuhuhuhuhuhu
TON resolver service URL [recovered]	https:huhuhuhuhuhuhuhuhuhuhu
TON resolver service URL role	TON rehuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name Value

Attribution

Name	Value
Attribution	`SalatStealer signature match: MALVA_SalatStealer_Go_Symbols. Signature-based attribution, not independent confirmation of the family or runtime behavior. This analysis does not execute the sample.`
Salat extraction	`Extraction is partial. Runtime-resolved C2s, remote responses and all behavioral settings are not established. No resolver or embedded endpoint was contacted.`
Info	Overlay extracted: Overlay_5aab2411.bin (312 bytes)

SalatStealer signature match: MALVA_SalatStealer_Go_Symbols. Signature-based attribution, not independent confirmation of the family or runtime behavior. This analysis does not execute the sample.

Salat extraction

Extraction is partial. Runtime-resolved C2s, remote responses and all behavioral settings are not established. No resolver or embedded endpoint was contacted.

Info

Overlay extracted: Overlay_5aab2411.bin (312 bytes)

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhuhuhuhuhu

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

1 malicious · 2 files

EXE5aca641bcbef3da1e9bdb93512a00df5Salat Stealer

Structure

BINSalat Stealer

BINOverlay_5aab2411.bin

Config. Field	Value
Extraction status	pahuhuhuhu
Configuration complete	Fhuhuhuhu
Authenticated startup values	5huhuhuhu
Recovered configuration XOR key	d0af20huhuhuhuhuhuhuhuhuhuhu
RSA modulus [recovered]	cc03d7huhuhuhuhuhuhuhuhuhuhu
RSA modulus role	Decodehuhuhuhuhuhuhuhuhuhuhu
Key derivation seed [recovered]	bhuhuhuhu
Key derivation seed role	Statichuhuhuhuhuhuhuhuhuhuhu
Startup constant 1 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 1 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 2 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 2 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 3 [authenticated]	https:huhuhuhuhuhuhuhuhuhuhu
Startup constant 3 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 4 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 4 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 5 [authenticated]	https:huhuhuhuhuhuhuhuhuhuhu
Startup constant 5 role	Confighuhuhuhuhuhuhuhuhuhuhu
TON resolver account [recovered]	Ef_lZ1huhuhuhuhuhuhuhuhuhuhu
TON resolver account role	Confighuhuhuhuhuhuhuhuhuhuhu
TON resolver service URL [recovered]	https:huhuhuhuhuhuhuhuhuhuhu
TON resolver service URL role	TON rehuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

5aca641bcbef3da1e9bdb93512a00df5

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

5aca641bcbef3da1e9bdb93512a00df5

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhuhuhuhuhu

5aca641bcbef3da1e9bdb93512a00df5

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

5aca641bcbef3da1e9bdb93512a00df5

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhuhuhuhuhu

5aca641bcbef3da1e9bdb93512a00df5

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

5aca641bcbef3da1e9bdb93512a00df5

Overview

Related Salat Stealer samples

Summary by MalvaGPT

Characteristics

File Structure

Malware Configuration — Salat Stealer configuration (partial)22

Information3

Artefacts5