db0ca572d489bdc9fbfe22e1fa4e728f

PE Executable

MD5: db0ca572d489bdc9fbfe22e1fa4e728f

Size: 12.57 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Salat Stealer (stealer). Static analysis extracted 1 embedded or derived file, a malware configuration (Salat Stealer configuration (partial)) and 5 command-and-control endpoints. It matches 2 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: be854910119b4ff25698c1d616d12ea286181d6d71ddf182a4d15d62973af59b
MD5: db0ca572d489bdc9fbfe22e1fa4e728f
Verdict: Malicious
File type: PE Executable · 12 MB
Family: Salat Stealer
Category: Stealer
C2 (defanged): hxxps://salator[.]es/sa1at/hxxps://wruser[.]org/sa1at/hxxps://websalat[.]top/sa1at/hxxps://sa1atik[.]cn/sa1at/hxxps://wruser[.]org:992/sa1at/

Cite this report: https://app.malva.re/sha256/be854910119b4ff25698c1d616d12ea286181d6d71ddf182a4d15d62973af59b

Related Salat Stealer samples

e592ffa52831ba007879fb83efa97556728ce9f7a04a097a67cbdf858ce873a7 2026-10-31
57ce811875c338ba2f30c83655390c5420c5c512d8ae4fc1e73ebbc116f856a8 2026-10-31
2c2d3d8feaead37bec50b41c2488aac1b2694e34dfafeb92a72c49533afd13d3 2026-10-31
476b8e1966c086eb279f19d828718aa67dd535376eb66bb02eba2fd6f2b0ccf2 2026-10-31
b101c2c3a989c632b3c74b26630d9188116f57d708df759edde7448209fa1f80 2026-10-31
697df858ed930b703860b58e62f1cc65e2cb01aef210e2e931ada5a0dbc6b67d 2026-10-31

All Salat Stealer analyses →

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

12.57 MB · 12,570,853 B

First seen

2026-10-31 00:30 · 2 hours ago

Last seen

2026-10-31 00:30 · 2 hours ago

Last analysis

2026-10-31 00:31 · 2 hours ago

Hashes

MD5 db0ca572d489bdc9fbfe22e1fa4e728f Sha1 9982fbfc1c4e9d5f3a946139f2623e6a8562454f Sha256 be854910119b4ff25698c1d616d12ea286181d6d71ddf182a4d15d62973af59b Sha384 550cde5323cbe6d0558f3562c0d591d7d9ebddd96d023dae2991386e9a0ebba3aee293b5d1280df03a97163f177583bf Sha512 6cfcbe0b37cefedd01b713e3896969791314056883ffda6d7707e8715e732f5a6cf7b83136f02aeef5d77349260931a68f609728371cd32cd991949616964c9e SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+t:yBkKr5rszpNDy+t TLSH 7EC65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files

EXEdb0ca572d489bdc9fbfe22e1fa4e728fSalat Stealer

Structure

BINOverlay_fe0c4042.bin

BINSalat Stealer

BINConfiguration

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Config. Field	Value
Extraction status	pahuhuhuhu
Configuration complete	Fhuhuhuhu
Authenticated startup values	5huhuhuhu
Recovered configuration XOR key	d0af20huhuhuhuhuhuhuhuhuhuhu
RSA modulus [recovered]	cc03d7huhuhuhuhuhuhuhuhuhuhu
RSA modulus role	Decodehuhuhuhuhuhuhuhuhuhuhu
Key derivation seed [recovered]	bhuhuhuhu
Key derivation seed role	Statichuhuhuhuhuhuhuhuhuhuhu
Startup constant 1 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 1 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 2 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 2 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 3 [authenticated]	https:huhuhuhuhuhuhuhuhuhuhu
Startup constant 3 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 4 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 4 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 5 [authenticated]	https:huhuhuhuhuhuhuhuhuhuhu
Startup constant 5 role	Confighuhuhuhuhuhuhuhuhuhuhu
TON resolver account [recovered]	Ef_lZ1huhuhuhuhuhuhuhuhuhuhu
TON resolver account role	Confighuhuhuhuhuhuhuhuhuhuhu
TON resolver service URL [recovered]	https:huhuhuhuhuhuhuhuhuhuhu
TON resolver service URL role	TON rehuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name Value

Info

Name	Value
Info	Overlay extracted: Overlay_fe0c4042.bin (229 bytes)
Attribution	`SalatStealer signature match: MALVA_SalatStealer_Go_Symbols. Signature-based attribution, not independent confirmation of the family or runtime behavior. This analysis does not execute the sample.`
Salat extraction	`Extraction is partial. Runtime-resolved C2s, remote responses and all behavioral settings are not established. No resolver or embedded endpoint was contacted.`

Overlay extracted: Overlay_fe0c4042.bin (229 bytes)

Attribution

SalatStealer signature match: MALVA_SalatStealer_Go_Symbols. Signature-based attribution, not independent confirmation of the family or runtime behavior. This analysis does not execute the sample.

Salat extraction

Extraction is partial. Runtime-resolved C2s, remote responses and all behavioral settings are not established. No resolver or embedded endpoint was contacted.

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhuhuhuhuhu

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

1 malicious · 2 files

EXEdb0ca572d489bdc9fbfe22e1fa4e728fSalat Stealer

Structure

BINOverlay_fe0c4042.bin

BINSalat Stealer

Config. Field	Value
Extraction status	pahuhuhuhu
Configuration complete	Fhuhuhuhu
Authenticated startup values	5huhuhuhu
Recovered configuration XOR key	d0af20huhuhuhuhuhuhuhuhuhuhu
RSA modulus [recovered]	cc03d7huhuhuhuhuhuhuhuhuhuhu
RSA modulus role	Decodehuhuhuhuhuhuhuhuhuhuhu
Key derivation seed [recovered]	bhuhuhuhu
Key derivation seed role	Statichuhuhuhuhuhuhuhuhuhuhu
Startup constant 1 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 1 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 2 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 2 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 3 [authenticated]	https:huhuhuhuhuhuhuhuhuhuhu
Startup constant 3 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 4 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 4 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 5 [authenticated]	https:huhuhuhuhuhuhuhuhuhuhu
Startup constant 5 role	Confighuhuhuhuhuhuhuhuhuhuhu
TON resolver account [recovered]	Ef_lZ1huhuhuhuhuhuhuhuhuhuhu
TON resolver account role	Confighuhuhuhuhuhuhuhuhuhuhu
TON resolver service URL [recovered]	https:huhuhuhuhuhuhuhuhuhuhu
TON resolver service URL role	TON rehuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

db0ca572d489bdc9fbfe22e1fa4e728f

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

db0ca572d489bdc9fbfe22e1fa4e728f

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhuhuhuhuhu

db0ca572d489bdc9fbfe22e1fa4e728f

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

db0ca572d489bdc9fbfe22e1fa4e728f

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhuhuhuhuhu

db0ca572d489bdc9fbfe22e1fa4e728f

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

db0ca572d489bdc9fbfe22e1fa4e728f

Overview

Related Salat Stealer samples

Summary by MalvaGPT

Characteristics

File Structure

Malware Configuration — Salat Stealer configuration (partial)22

Information3

Artefacts5