MALICIOUS — 58786663acbf0f9d7572aa61bb95cac9ca918c7732e9833e4b384c9ddc30c986.exe

MALICIOUS — 58786663acbf0f9d7572aa61bb95cac9ca918c7732e9833e4b384c9ddc30c986.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Salat family. 10 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 58786663acbf0f9d7572aa61bb95cac9ca918c7732e9833e4b384c9ddc30c986
• SHA-1: 0c1e182a7179a63bc79b649c42e0d78b11532201
• MD5: 0603a9c2cc3efa9e1e6ca5f12d332d9f
• imphash: 1aae8bf580c846f39c71c05898e57e88
• ssdeep: 98304:8uNkNJysdLgpiGXXXwM7GOrp4S3HVdjEaO/:gynpXnJFpTWaO/
• TLSH: T1CC6D7DB19A85B792FFF4F874D224839C21BB225552BB0ECE4387D62050E7857097F292
• Submitted as: 58786663acbf0f9d7572aa61bb95cac9ca918c7732e9833e4b384c9ddc30c986.exe
• File type: pe · Size: 12571648 bytes
• Verdict: malicious (100/100) · Family: Salat

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (10 of 55 engines)

• YARA: MalwareAnalyser built-in: Generic_Credential_Theft_Strings
• capa (capabilities): capability:credential-access
• ClamAV (daily): Win.Malware.Salat-10058846-0
• YARA: JPCERT/CC: JPCERT_LODEINFO
• YARA: ReversingLabs: RL_RedLine_Stealer
• Hash: abuse.ch ThreatFox: known-malicious-hash
• Microsoft Defender: Trojan:Win32/SalatStealer!pz
• Emsisoft (Emergency Kit): Trojan.LummaStealer.103
• Trellix Stinger (McAfee): SalatStealer!0603A9C2CC3E
• Kaspersky (KVRT): HEUR:Trojan-PSW.Win32.Convagent.gen

MITRE ATT&CK

• T1555
• T1003
• T1057
• T1056.001

YARA

• Generic_Credential_Theft_Strings

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

• ClamAV (daily) flagged Win.Malware.Salat-10058846-0 (rule Win.Malware.Salat-10058846-0) - engine signal, weight 0.90, confidence 0.95
• Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
• References to browser/OS credential stores (rule Generic_Credential_Theft_Strings) - yara signal, weight 0.60, confidence 0.90
• access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_LODEINFO (rule JPCERT_LODEINFO) - engine signal, weight 0.35, confidence 0.70
• YARA: ReversingLabs flagged RL_RedLine_Stealer (rule RL_RedLine_Stealer) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://go.dev/issue/66821, https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size, 5.4.62.5 - static signal, weight 0.35, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://go.dev/issue/66821
• https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes
• https://github.com/quic-go/quic-go/wiki/Loggingnistec
• https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size

Embedded domains

• big.int
• abi.name
• pkix.name
• wasm.store
• godebugs.info
• github.com
• golang.org
• 0github.com
• 1github.com
• 2github.com
• 4github.com
• 8github.com
• 9github.com
• json.name
• atomic.storei64.atomic.store
• cloudflare-dns.com
• go.dev
• enabledgithub.com
• atomic.store
• runtime.link
• reflectlite.name.name
• reflectlite.rtype.name
• unicode.to
• unicode.to
• eq.io

Embedded IP addresses

• 5.4.62.5
• 4.32.5.4
• 52.5.4.72
• 5.4.82.5
• 5.4.102.5
• 4.112.5.4
• 1.1.1.1
• 2.2.1.1

File paths

• C:\Windows\Sysnative\restore\MachineGuid.txt\LocalCache\Roaming\Mozilla\Firefox\ProfilessxxuJBrIRnKNqcH6xJNmUc/7lE0UOrgWJ2vMbaAoR4c=tls:
• C:\:k:
• B:\:o:
• J:\:d:
• J:\:n:
• R:\:
• T:\:`:
• X:\:`:d:
• X:\:d:h:
• X:\:d:h:p:t:
• T:\:`:h:l:
• T:\:`:h:l:t:x:
• T:\:d:l:t:
• T:\:`:d:l:
• X:\:`:d:l:p:t:x:
• X:\:`:d:h:l:p:t:x:
• X:\:h:l:x:
• X:\:h:x:
• P:\:p:

More Salat samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report