e54df3304d6dda35f937441a1e3a4d88

PE Executable

MD5: e54df3304d6dda35f937441a1e3a4d88

Size: 12.57 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Salat Stealer (stealer). Static analysis extracted 1 embedded or derived file, a malware configuration (Salat Stealer configuration (partial)) and 5 command-and-control endpoints. It matches 2 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: 12fb217b6e76df651291af30eb1c2e07f7890fcc06b8f2494afb658d99471abc
MD5: e54df3304d6dda35f937441a1e3a4d88
Verdict: Malicious
File type: PE Executable · 12 MB
Family: Salat Stealer
Category: Stealer
C2 (defanged): hxxps://salator[.]es/sa1at/hxxps://wruser[.]org/sa1at/hxxps://websalat[.]top/sa1at/hxxps://sa1atik[.]cn/sa1at/hxxps://wruser[.]org:992/sa1at/

Cite this report: https://app.malva.re/sha256/12fb217b6e76df651291af30eb1c2e07f7890fcc06b8f2494afb658d99471abc

Related Salat Stealer samples

3fe04b42445dd4e08735c7bca2b091f14272fc7c25043231a209846990c53aac 2026-10-31
1864be0b69e60285e2605bb31b13f69c30324d741feedabdbefcfe0e25226910 2026-10-31
16af7c8b76e9ad83ccdce30f149ea399ce28cb2d56b2b013d4e31fcdeaaa2908 2026-10-31
2c28fcab0fb09576842a3b77f5227e878f27f5a1f6f83875c77974d99c439d41 2026-10-31
034f7817fab44a5d72f428170f8be4a2faa07e20ede49a4a0908ab05c422a1c1 2026-10-31
93d8e5e8b84f00349042af393b0b8f8bf5de10939029baa103c6eeae5a2df9f0 2026-10-31

All Salat Stealer analyses →

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Size

12.57 MB · 12,570,955 B

First seen

2026-10-31 02:30 · 2 hours ago

Last seen

2026-10-31 02:30 · 2 hours ago

Last analysis

2026-10-31 02:31 · 2 hours ago

Hashes

MD5 e54df3304d6dda35f937441a1e3a4d88 Sha1 2a37739be3a0365c79d64ddf8e4dfbdc32c6f0ab Sha256 12fb217b6e76df651291af30eb1c2e07f7890fcc06b8f2494afb658d99471abc Sha384 79a730c638bf747ca00df310abefe4bb14f0662240d18b4542d97f3b410b109606efc94748574931243cbc104589c569 Sha512 c488b8f7bc0fa02b418082df9b2d810c0cbbd147710e904a4b41f2a1c1f381dc40d0827f79fc7da5cd991a7decd3c75ff855063eb1d6c5b4b94ff802b780a2e8 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+z:yBkKr5rszpNDy+z TLSH 04C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files

EXEe54df3304d6dda35f937441a1e3a4d88Salat Stealer

Structure

BINSalat Stealer

BINConfiguration

BINOverlay_c56de077.bin

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Config. Field	Value
Extraction status	pahuhuhuhu
Configuration complete	Fhuhuhuhu
Authenticated startup values	5huhuhuhu
Recovered configuration XOR key	d0af20huhuhuhuhuhuhuhuhuhuhu
RSA modulus [recovered]	cc03d7huhuhuhuhuhuhuhuhuhuhu
RSA modulus role	Decodehuhuhuhuhuhuhuhuhuhuhu
Key derivation seed [recovered]	bhuhuhuhu
Key derivation seed role	Statichuhuhuhuhuhuhuhuhuhuhu
Startup constant 1 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 1 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 2 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 2 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 3 [authenticated]	https:huhuhuhuhuhuhuhuhuhuhu
Startup constant 3 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 4 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 4 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 5 [authenticated]	https:huhuhuhuhuhuhuhuhuhuhu
Startup constant 5 role	Confighuhuhuhuhuhuhuhuhuhuhu
TON resolver account [recovered]	Ef_lZ1huhuhuhuhuhuhuhuhuhuhu
TON resolver account role	Confighuhuhuhuhuhuhuhuhuhuhu
TON resolver service URL [recovered]	https:huhuhuhuhuhuhuhuhuhuhu
TON resolver service URL role	TON rehuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name Value

Attribution

Name	Value
Attribution	`SalatStealer signature match: MALVA_SalatStealer_Go_Symbols. Signature-based attribution, not independent confirmation of the family or runtime behavior. This analysis does not execute the sample.`
Salat extraction	`Extraction is partial. Runtime-resolved C2s, remote responses and all behavioral settings are not established. No resolver or embedded endpoint was contacted.`
Info	Overlay extracted: Overlay_c56de077.bin (331 bytes)

SalatStealer signature match: MALVA_SalatStealer_Go_Symbols. Signature-based attribution, not independent confirmation of the family or runtime behavior. This analysis does not execute the sample.

Salat extraction

Extraction is partial. Runtime-resolved C2s, remote responses and all behavioral settings are not established. No resolver or embedded endpoint was contacted.

Info

Overlay extracted: Overlay_c56de077.bin (331 bytes)

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhuhuhuhuhu

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

1 malicious · 2 files

EXEe54df3304d6dda35f937441a1e3a4d88Salat Stealer

Structure

BINSalat Stealer

BINOverlay_c56de077.bin

Config. Field	Value
Extraction status	pahuhuhuhu
Configuration complete	Fhuhuhuhu
Authenticated startup values	5huhuhuhu
Recovered configuration XOR key	d0af20huhuhuhuhuhuhuhuhuhuhu
RSA modulus [recovered]	cc03d7huhuhuhuhuhuhuhuhuhuhu
RSA modulus role	Decodehuhuhuhuhuhuhuhuhuhuhu
Key derivation seed [recovered]	bhuhuhuhu
Key derivation seed role	Statichuhuhuhuhuhuhuhuhuhuhu
Startup constant 1 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 1 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 2 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 2 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 3 [authenticated]	https:huhuhuhuhuhuhuhuhuhuhu
Startup constant 3 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 4 [authenticated]	https:huhuhuhuhuhuhu
Startup constant 4 role	Confighuhuhuhuhuhuhuhuhuhuhu
Startup constant 5 [authenticated]	https:huhuhuhuhuhuhuhuhuhuhu
Startup constant 5 role	Confighuhuhuhuhuhuhuhuhuhuhu
TON resolver account [recovered]	Ef_lZ1huhuhuhuhuhuhuhuhuhuhu
TON resolver account role	Confighuhuhuhuhuhuhuhuhuhuhu
TON resolver service URL [recovered]	https:huhuhuhuhuhuhuhuhuhuhu
TON resolver service URL role	TON rehuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

e54df3304d6dda35f937441a1e3a4d88

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

e54df3304d6dda35f937441a1e3a4d88

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhuhuhuhuhu

e54df3304d6dda35f937441a1e3a4d88

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhu

e54df3304d6dda35f937441a1e3a4d88

Salat configured C2 CNCmalicious

https:huhuhuhuhuhuhuhuhuhuhu

e54df3304d6dda35f937441a1e3a4d88

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

e54df3304d6dda35f937441a1e3a4d88

Overview

Related Salat Stealer samples

Summary by MalvaGPT

Characteristics

File Structure

Malware Configuration — Salat Stealer configuration (partial)22

Information3

Artefacts5