MALICIOUS — 0654bae7cd7c16a4ebebc4aeeef6dec0dfe5f6247416593ec33c507db14c2348.exe

MALICIOUS — 0654bae7cd7c16a4ebebc4aeeef6dec0dfe5f6247416593ec33c507db14c2348.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the SalatStealer family. 11 of 25 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 0654bae7cd7c16a4ebebc4aeeef6dec0dfe5f6247416593ec33c507db14c2348
• SHA-1: df5df54aaa250168f71ffdf00c99d345b58bb581
• MD5: c68ce967bc43a30fd83b0a70ba36eb93
• imphash: 1aae8bf580c846f39c71c05898e57e88
• ssdeep: 49152:DYUlVNiu5DsMfib7KqdRCp4YCfKwtpVAboXIvyzqdZtAPt2FW5hNTqMtWLmLdKO:flPFgKqTgvCLtcc/cFQjtij44vpE1k
• TLSH: T1536D8DB19A85B795EFF4F8B4D220839C20AB625552770ECD4397CA71A0D3C23497F292
• Submitted as: 0654bae7cd7c16a4ebebc4aeeef6dec0dfe5f6247416593ec33c507db14c2348.exe
• File type: pe · Size: 12573184 bytes
• Verdict: malicious (100/100) · Family: SalatStealer

Detections (11 of 25 engines)

• YARA: MalwareAnalyser built-in: Generic_Credential_Theft_Strings
• capa (capabilities): capability:credential-access
• YARA: JPCERT/CC: JPCERT_LODEINFO
• YARA: Trellix/McAfee ATR: ATR_REvil_Sodinokibi
• YARA: ReversingLabs: RL_RedLine_Stealer
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• Hash: abuse.ch ThreatFox: known-malicious-hash
• Microsoft Defender: Trojan:Win32/SalatStealer!pz
• Emsisoft (Emergency Kit): Trojan.LummaStealer.103
• Trellix Stinger (McAfee): SalatStealer!C68CE967BC43
• Kaspersky (KVRT): Trojan-Banker.Win32.Agent.gen

MITRE ATT&CK

• T1555
• T1003
• T1057
• T1056.001

YARA

• Generic_Credential_Theft_Strings

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

• Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
• References to browser/OS credential stores (rule Generic_Credential_Theft_Strings) - yara signal, weight 0.60, confidence 0.90
• Microsoft Defender flagged Trojan:Win32/SalatStealer!pz (rule Trojan:Win32/SalatStealer!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.LummaStealer.103 (rule Trojan.LummaStealer.103) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged SalatStealer!C68CE967BC43 (rule SalatStealer!C68CE967BC43) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan-Banker.Win32.Agent.gen (rule Trojan-Banker.Win32.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_LODEINFO (rule JPCERT_LODEINFO) - engine signal, weight 0.35, confidence 0.70
• YARA: Trellix/McAfee ATR flagged ATR_REvil_Sodinokibi (rule ATR_REvil_Sodinokibi) - engine signal, weight 0.35, confidence 0.70
• YARA: ReversingLabs flagged RL_RedLine_Stealer (rule RL_RedLine_Stealer) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://go.dev/issue/66821, https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size, 5.4.62.5 - static signal, weight 0.35, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://go.dev/issue/66821
• https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes
• https://github.com/quic-go/quic-go/wiki/Loggingnistec
• https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size

Embedded domains

• big.int
• abi.name
• pkix.name
• wasm.store
• godebugs.info
• github.com
• golang.org
• 0github.com
• 1github.com
• 2github.com
• 4github.com
• 8github.com
• 9github.com
• json.name
• atomic.storei64.atomic.store
• cloudflare-dns.com
• go.dev
• enabledgithub.com
• atomic.store
• runtime.link
• reflectlite.name.name
• reflectlite.rtype.name
• unicode.to
• unicode.to
• eq.io

Embedded IP addresses

• 5.4.62.5
• 4.32.5.4
• 52.5.4.72
• 5.4.82.5
• 5.4.102.5
• 4.112.5.4
• 1.1.1.1
• 2.2.1.1

File paths

• C:\:k:
• B:\:o:
• A:\:e:
• O:\:b:m:s:
• T:\:`:
• X:\:`:d:
• X:\:d:h:
• X:\:d:h:p:t:
• T:\:`:h:l:
• T:\:`:h:l:t:x:
• X:\:`:d:h:l:p:t:x:
• T:\:`:d:h:p:t:
• X:\:`:d:l:p:t:x:
• X:\:`:d:h:
• X:\:h:l:x:
• X:\:h:x:
• P:\:p:

More SalatStealer samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report