Salat Stealer PE Executable malware analysis – 5699f35b8ab0

Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Salat Stealer (stealer). Static analysis extracted a malware configuration (Salat Stealer configuration (partial)) and 5 command-and-control endpoints. It matches 2 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: 5699f35b8ab0e59371a9a88405e5c520c375b0244cb3e8cf650fac5f5a06e18b
MD5: 6c189d380468a3ee530454f14b06ea9f
Verdict: Malicious
File type: PE Executable · 12 MB
Family: Salat Stealer
Category: Stealer
C2 (defanged): hxxps://salator[.]es/sa1at/hxxps://wruser[.]org/sa1at/hxxps://websalat[.]top/sa1at/hxxps://salat[.]cn/sa1at/hxxps://wrat[.]in/sa1at/

Cite this report: https://app.malva.re/sha256/5699f35b8ab0e59371a9a88405e5c520c375b0244cb3e8cf650fac5f5a06e18b

Related Salat Stealer samples

240953017b83c6de8459fae6bd3e2f917efac9791373a3b178a1d1faab0c42f3 2026-10-31
c8842b6fb7c9dec93390391324ef88eb5eaa0186e225f7be2bce1814b312bab1 2026-10-31
8d67fc5fdeec6ea71f3dd0504efdc9f73f412041940fd3a4c2577a2a5033d60d 2026-10-31
be854910119b4ff25698c1d616d12ea286181d6d71ddf182a4d15d62973af59b 2026-10-31
94ddbbf41d74f55ee279c04859f25386ae4c85e090112bad193670f774a1c94a 2026-10-31
1ecd98d67a103fbeb043c816e4e7c30a58d2119c99c17db0a4371d23f5e69791 2026-10-31

All Salat Stealer analyses →

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

12.57 MB · 12,572,160 B

First seen

2026-10-31 00:15 · an hour ago

Last seen

2026-10-31 00:15 · an hour ago

Last analysis

2026-10-31 00:16 · an hour ago

Hashes

MD5 6c189d380468a3ee530454f14b06ea9f Sha1 e515a6f6e391f4b2fc507b43d84c5d220c262334 Sha256 5699f35b8ab0e59371a9a88405e5c520c375b0244cb3e8cf650fac5f5a06e18b Sha384 24fbc244ecf04277b537f00ac244b0fb80e06a849f680e833ba7acf2cb5ec2e56dbbddc9cda2cce5a46b8d9a9f31b140 Sha512 074c5555661f2dea896d434398d42a39302fbbb44fb103ac4caac9d3ebfb050d4f4b0d68d7392df10fbeb44e98f32463da670def7cc4b5a6b8ed4ca3ea1cf128 SSDeep 98304:HKlnXP5LW7fQiG/QtFhH8Sc/oM4vQEqz:U5Ec/egScwMepW TLSH 73C65B11FACB58F5E9035831406BB37F23315D048B28DB9BEB143B6AF87B6A1197A705

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file

EXE6c189d380468a3ee530454f14b06ea9fSalat Stealer

Structure

BINSalat Stealer

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe

Shape pe:exe

malicious 1 nodes

Config. Field	Value
Extraction status	pahuhuhuhu
Configuration complete	Fhuhuhuhu
Authenticated startup values	7huhuhuhu
Recovered configuration XOR key	d0af20huhuhuhuhuhuhuhuhuhuhu
RSA modulus [recovered]	cc03d7huhuhuhuhuhuhuhuhuhuhu
RSA modulus role	Decodehuhuhuhuhuhuhuhuhuhuhu
Key derivation seed [recovered]	bhuhuhuhu
Key derivation seed role	Statichuhuhuhuhuhuhuhuhuhuhu
Startup constant 1 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 1 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 2 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 2 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 3 [authenticated]	https:huhuhuhuhuhuhuhuhuhuhu
Startup constant 3 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 4 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 4 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 5 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 5 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 6 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 6 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 7 [authenticated]	https:huhuhuhuhuhuhuhuhuhuhu
Startup constant 7 role	Confighuhuhuhuhuhuhuhuhuhuhu
TON resolver account [recovered]	Ef_lZ1huhuhuhuhuhuhuhuhuhuhu
TON resolver account role	Confighuhuhuhuhuhuhuhuhuhuhu
TON resolver service URL [recovered]	https:huhuhuhuhuhuhuhuhuhuhu
TON resolver service URL role	TON rehuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name Value

Attribution

Name	Value
Attribution	`SalatStealer signature match: MALVA_SalatStealer_Go_Symbols. Signature-based attribution, not independent confirmation of the family or runtime behavior. This analysis does not execute the sample.`
Salat extraction	`Extraction is partial. Runtime-resolved C2s, remote responses and all behavioral settings are not established. No resolver or embedded endpoint was contacted.`

SalatStealer signature match: MALVA_SalatStealer_Go_Symbols. Signature-based attribution, not independent confirmation of the family or runtime behavior. This analysis does not execute the sample.

Salat extraction

Extraction is partial. Runtime-resolved C2s, remote responses and all behavioral settings are not established. No resolver or embedded endpoint was contacted.