Malicious
fd81f72c80163a9f2b5e8debf48294db
PE Executable
MD5: fd81f72c80163a9f2b5e8debf48294db
Size: 3.6 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 3.4 MB PE Executable identified by Malva.RE as Salat Stealer (stealer). Static analysis extracted 1 embedded or derived file, a malware configuration (Salat Stealer configuration (partial)) and 5 command-and-control endpoints. It matches 3 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- a0150547114a3b5d48728afe684c983aa4fe4cb950f791cb120b2256ba39847d
- MD5
- fd81f72c80163a9f2b5e8debf48294db
- Verdict
- Malicious
- File type
- PE Executable · 3.4 MB
- Family
- Salat Stealer
- Category
- Stealer
- C2 (defanged)
hxxps://salator[.]es/sa1at/hxxps://wruser[.]org/sa1at/hxxps://websalat[.]top/sa1at/hxxps://sa1atik[.]cn/sa1at/hxxps://wruser[.]org:992/sa1at/
Cite this report: https://app.malva.re/sha256/a0150547114a3b5d48728afe684c983aa4fe4cb950f791cb120b2256ba39847d
Related Salat Stealer samples
- 58a6d06873b5773ae10d442cd8fda21b5dc79fb7ca340dc3062f48ec2d280a8c 2026-10-30
- b8b1c14015de8e04efa1fcfcd95a71b79c89cdc788aacfb2e91cff5b6604772c 2026-10-30
- 318a039986594d58b3b669c716d8f7a13a261699f10ed82f8b5ef14234bbb4da 2026-10-30
- bb32aad3a82e3f608aabb57e1b2744f97e18373872b8fee7749abd5500bf4ff5 2026-10-30
- d13b1625624298fa966c3f63bc29db048111c03219d6f9a732b63b951f14e385 2026-10-30
- 7b1e6a0f78057136d95643a801652649afb64b25798d6b296ee2b58025093eef 2026-10-30
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
3.6 MB · 3,596,288 B
First seen
2026-10-30 02:45 · an hour ago
Last seen
2026-10-30 02:45 · an hour ago
Last analysis
2026-10-30 02:45 · an hour ago
Hashes
MD5
fd81f72c80163a9f2b5e8debf48294db
Sha1
b33ed482e831fc6cd4e8cd785e70fb091365a464
Sha256
a0150547114a3b5d48728afe684c983aa4fe4cb950f791cb120b2256ba39847d
Sha384
612fbb264512bb90491e03d2ff58fa96f30a013a7c752fa0557345117292e278fb183fe802743cafbcc4c2914cbfde7c
Sha512
1f91d106c3e16b327a603f19a1eeee0b710a4731b0e5f5de0a65267f71beff6b4b2fce9413384b80c2b225fb6de8d650b9f257f1c1d6c691c8878db0152c52fb
SSDeep
98304:4rftowsSFWUSQqq7IQIgJ327j/ec0qAmxGgI:4rFTsSFzS/q7isG3e7oGR
TLSH
7FF53380464181E4F2E1637BF3996851E82A0F9E53239FBB2D6CF86A87D07D1F1B7152
Detection
PeID
Microsoft Visual C++ v6.0 DLLUPX -> www.upx.sourceforge.netUPX 2.93 - 3.95 (LZMA) ASL sign UPX 3.02UPX v3.0UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser
2 malicious · 2 files
EXEfd81f72c80163a9f2b5e8debf48294dbSalat Stealer
Structure
EXE[UPX unpacked Lzma].exeSalat Stealer
Structure
BINSalat Stealer
BINConfiguration
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe
Shape
pe:exe
malicious
1 nodes
| Config. Field | Value |
|---|---|
| Extraction status | pahuhuhuhu |
| Configuration complete | Fhuhuhuhu |
| Authenticated startup values | 5huhuhuhu |
| Recovered configuration XOR key | d0af20huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus [recovered] | cc03d7huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus role | Decodehuhuhuhuhuhuhuhuhuhuhu |
| Key derivation seed [recovered] | bhuhuhuhu |
| Key derivation seed role | Statichuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 1 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 1 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 2 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 2 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 4 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 4 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver account [recovered] | Ef_lZ1huhuhuhuhuhuhuhuhuhuhu |
| TON resolver account role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL [recovered] | https:huhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL role | TON rehuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| UPX | UPX method: Lzma, filter: X86CallJumpBe |
| UPX | |
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential2 malicious · 2 files
EXEfd81f72c80163a9f2b5e8debf48294dbSalat Stealer
Structure
EXE[UPX unpacked Lzma].exeSalat Stealer
Structure
BINSalat Stealer
| Config. Field | Value |
|---|---|
| Extraction status | pahuhuhuhu |
| Configuration complete | Fhuhuhuhu |
| Authenticated startup values | 5huhuhuhu |
| Recovered configuration XOR key | d0af20huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus [recovered] | cc03d7huhuhuhuhuhuhuhuhuhuhu |
| RSA modulus role | Decodehuhuhuhuhuhuhuhuhuhuhu |
| Key derivation seed [recovered] | bhuhuhuhu |
| Key derivation seed role | Statichuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 1 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 1 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 2 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 2 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 3 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 4 [authenticated] | https:huhuhuhuhuhuhu |
| Startup constant 4 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 [authenticated] | https:huhuhuhuhuhuhuhuhuhuhu |
| Startup constant 5 role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver account [recovered] | Ef_lZ1huhuhuhuhuhuhuhuhuhuhu |
| TON resolver account role | Confighuhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL [recovered] | https:huhuhuhuhuhuhuhuhuhuhu |
| TON resolver service URL role | TON rehuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialSalat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
fd81f72c80163a9f2b5e8debf48294db › fd81f72c80163a9f2b5e8debf48294db › [UPX unpacked Lzma].exe
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
fd81f72c80163a9f2b5e8debf48294db › fd81f72c80163a9f2b5e8debf48294db › [UPX unpacked Lzma].exe
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
fd81f72c80163a9f2b5e8debf48294db › fd81f72c80163a9f2b5e8debf48294db › [UPX unpacked Lzma].exe
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhu
fd81f72c80163a9f2b5e8debf48294db › fd81f72c80163a9f2b5e8debf48294db › [UPX unpacked Lzma].exe
Salat configured C2
CNCmalicious
https:huhuhuhuhuhuhuhuhuhuhu
fd81f72c80163a9f2b5e8debf48294db › fd81f72c80163a9f2b5e8debf48294db › [UPX unpacked Lzma].exe
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account