MALICIOUS — 7261c4276f44e0ac3b2ef43ba4de223ce1278db20286750608777f41df0d68fd.exe

MALICIOUS — 7261c4276f44e0ac3b2ef43ba4de223ce1278db20286750608777f41df0d68fd.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Salat family. 10 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 7261c4276f44e0ac3b2ef43ba4de223ce1278db20286750608777f41df0d68fd
• SHA-1: 61a93e1deb3b225f54f8cb915a88c38ce5578d44
• MD5: 699a48056ea661dd446df61d4b107fa8
• imphash: 1aae8bf580c846f39c71c05898e57e88
• ssdeep: 98304:tun+uBu7zmCvjkqwntcKNGAr4tG20CzEc0:juK/jl4cKQ0Ht1
• TLSH: T1766D7DB19A85B795EFF4F8B4D220879D20AB621552B70ECD4387CA6160D7C23097F2D2
• Submitted as: 7261c4276f44e0ac3b2ef43ba4de223ce1278db20286750608777f41df0d68fd.exe
• File type: pe · Size: 12572160 bytes
• Verdict: malicious (100/100) · Family: Salat

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (10 of 55 engines)

• YARA: MalwareAnalyser built-in: Generic_Credential_Theft_Strings
• capa (capabilities): capability:credential-access
• ClamAV (daily): Win.Malware.Salat-10058846-0
• YARA: JPCERT/CC: JPCERT_LODEINFO
• YARA: ReversingLabs: RL_RedLine_Stealer
• Hash: abuse.ch ThreatFox: known-malicious-hash
• Microsoft Defender: Trojan:Win32/SalatStealer!pz
• Emsisoft (Emergency Kit): Trojan.LummaStealer.103
• Trellix Stinger (McAfee): SalatStealer!699A48056EA6
• Kaspersky (KVRT): HEUR:Trojan-PSW.Win32.Convagent.gen

MITRE ATT&CK

• T1555
• T1003
• T1057
• T1056.001

YARA

• Generic_Credential_Theft_Strings

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

• ClamAV (daily) flagged Win.Malware.Salat-10058846-0 (rule Win.Malware.Salat-10058846-0) - engine signal, weight 0.90, confidence 0.95
• Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
• References to browser/OS credential stores (rule Generic_Credential_Theft_Strings) - yara signal, weight 0.60, confidence 0.90
• access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_LODEINFO (rule JPCERT_LODEINFO) - engine signal, weight 0.35, confidence 0.70
• YARA: ReversingLabs flagged RL_RedLine_Stealer (rule RL_RedLine_Stealer) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://go.dev/issue/66821, https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size, 5.4.62.5 - static signal, weight 0.35, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://go.dev/issue/66821
• https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes
• https://github.com/quic-go/quic-go/wiki/Loggingnistec
• https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size

Embedded domains

• big.int
• abi.name
• pkix.name
• wasm.store
• godebugs.info
• github.com
• golang.org
• 0github.com
• 1github.com
• 2github.com
• 4github.com
• 8github.com
• 9github.com
• json.name
• atomic.storei64.atomic.store
• cloudflare-dns.com
• go.dev
• enabledgithub.com
• atomic.store
• runtime.link
• reflectlite.name.name
• reflectlite.rtype.name
• unicode.to
• unicode.to
• eq.io

Embedded IP addresses

• 5.4.62.5
• 4.32.5.4
• 52.5.4.72
• 5.4.82.5
• 5.4.102.5
• 4.112.5.4
• 1.1.1.1
• 2.2.1.1

File paths

• C:\:k:
• B:\:o:
• A:\:e:
• O:\:b:m:s:
• T:\:`:
• X:\:`:d:
• X:\:d:h:
• X:\:d:h:p:t:
• T:\:`:h:l:
• T:\:`:h:l:t:x:
• T:\:d:l:t:
• T:\:`:d:l:p:t:
• T:\:`:d:h:p:t:x:
• X:\:d:h:l:p:t:
• T:\:`:d:h:l:p:t:
• X:\:`:d:h:l:p:t:x:
• X:\:h:l:x:
• X:\:h:x:
• P:\:p:

More Salat samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report