MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08ca4ac0b2ef5742ba956cac67c58d428142998ab8be88df1b105cea5702af8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SalatStealer

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	08ca4ac0b2ef5742ba956cac67c58d428142998ab8be88df1b105cea5702af8d
SHA3-384 hash:	35cf06079821050ebe3cd4b3f0c1a8e3e6e1742adf288f1941e6beb882040d03f259f890ff1c16cfe82dd66c1b42fbfb
SHA1 hash:	e153ebb4f715f9f4f8ed593951c819bb027ce481
MD5 hash:	5e636ac3375d8564865fb3f6c87a25d4
humanhash:	ack-mango-maine-skylark
File name:	zapret-discord-youtube-1.9.9d.rar
Download:	download sample
Signature	SalatStealer Create hunting rule
File size:	9'627'187 bytes
First seen:	2026-08-11 16:45:56 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	196608:BJsKw0UmYEGKIrJh6k24I7030k38VbwM8juG4AhVFjYrKieYEnA:BSKw0LYVKcw3tVkbuG4Av6rjb
TLSH	T179A6332CCE7DF151B8E78D725A72A1C6C266C6AD942F1BE8CEC0A4285365447873D33E
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	Alex_sev
Tags:	bat dropper rar salat SalatStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 42 file(s), sorted by their relevance:

File name:	general.bat
File size:	3'378 bytes
SHA256 hash:	c4f7f5708de5323b55ea85e2ef140c43426352875593eae1c0b94bfc769a4477
MD5 hash:	0ac556c85f0d739609285815922d1699
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	quic_initial_dbankcloud_ru.bin
File size:	1'250 bytes
SHA256 hash:	e065870cb0d13152e6132807bbf42218a9e7cd8d96f5602b61674cc540f3a56e
MD5 hash:	6422bac6b3e976bab5d21451b834221f
MIME type:	application/octet-stream
Signature	SalatStealer

File name:	general (FAKE TLS AUTO ALT2).bat
File size:	4'327 bytes
SHA256 hash:	1e9a3d1fe257f10c9355dbef5a45cca9765b57e2ce1f549225c68c86ff1c8d8b
MD5 hash:	1ce3caa8f2ffb279c6435ff245db45cf
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	general (ALT9).bat
File size:	3'235 bytes
SHA256 hash:	4b8f50bd2b5cd71c0a883461d4a526a2cd9494a87847907807d06c233166c2c9
MD5 hash:	4d6ced8c4790b06aba64d176a2ba5e9a
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	WinDivert64.sys
File size:	94'144 bytes
SHA256 hash:	8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
MD5 hash:	89ed5be7ea83c01d0de33d3519944aa5
MIME type:	application/x-dosexec
Signature	SalatStealer

File name:	ipset-all.txt
File size:	18 bytes
SHA256 hash:	19123a22bf1108815c07bda3cda8df282b30bd63e4939949928969c0fd195873
MD5 hash:	42ad35639873f78e1b2dc5c1039499df
MIME type:	text/plain
Signature	SalatStealer

File name:	stun.bin
File size:	100 bytes
SHA256 hash:	9cd5469309780ca56c0bd97266524a48c7ee529d02c3179cfecb20b260a59641
MD5 hash:	0357596c0e38a10a4b99dca2032419cc
MIME type:	application/octet-stream
Signature	SalatStealer

File name:	ipset-all.txt.backup
File size:	525'467 bytes
SHA256 hash:	1fb91430a8594b2632d41a87b5bf071ce851ffb5b4d470b965d1db2b60d3ee94
MD5 hash:	159fbec389464bf9d2719641f9f5e0cc
MIME type:	text/plain
Signature	SalatStealer

File name:	SHA256SUMS.txt
File size:	3'889 bytes
SHA256 hash:	ed2e8b14040a6af35ee88e94344e133c481f3941bb90a353f2f612b79b06acf0
MD5 hash:	8133e194ca7dff1da73ba60c6f50f8dc
MIME type:	text/plain
Signature	SalatStealer

File name:	winws.exe
File size:	203'776 bytes
SHA256 hash:	affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
MD5 hash:	d498e19bc7a79dd1efcb6b928cbe9909
MIME type:	application/x-dosexec
Signature	SalatStealer

File name:	general (ALT2).bat
File size:	3'399 bytes
SHA256 hash:	94a8ef4dc67c5e04100c404604883cee6a7d8ad5d324395ecd71dc8ccb805d80
MD5 hash:	802a10c9f71f69ebe61eeae7693ba0e5
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	general (ALT3).bat
File size:	3'611 bytes
SHA256 hash:	99c06ea66bdade72d43febbf4e5bd6208351ebd471fa99a39a92253e21526c05
MD5 hash:	aa4abe5d986341f92ed5529c58002d5c
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	WinDivert.dll
File size:	47'616 bytes
SHA256 hash:	c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
MD5 hash:	b2014d33ee645112d5dc16fe9d9fcbff
MIME type:	application/x-dosexec
Signature	SalatStealer

File name:	tls_clienthello_4pda_to.bin
File size:	284 bytes
SHA256 hash:	eefeaf09dde8d69b1f176212541f63c68b314a33a335eced99a8a29f17254da8
MD5 hash:	e6d649de132c3c10cb62531ef74f5b73
MIME type:	application/octet-stream
Signature	SalatStealer

File name:	test zapret.ps1
File size:	39'106 bytes
SHA256 hash:	f31ced248fee999c780d1361d2a244ff2a63c7feb57f5678176367ef5d2b0e15
MD5 hash:	82c0648c9e124331bb53a8bef9555492
MIME type:	text/plain
Signature	SalatStealer

File name:	general (SIMPLE FAKE ALT2).bat
File size:	3'530 bytes
SHA256 hash:	7ad976ec3968a3dce1e0b54b81e77ec1f925a78eb31930deeaa8359b23201f1a
MD5 hash:	19254d284a9643e034b0dc548bdb1dc4
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	cygwin1.dll
File size:	2'954'293 bytes
SHA256 hash:	103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
MD5 hash:	a1c82ed072dc079dd7851f82d9aa7678
MIME type:	application/x-dosexec
Signature	SalatStealer

File name:	general (ALT12).bat
File size:	4'091 bytes
SHA256 hash:	3f28b3788373c4963ba7b4e38112ae965fef2c99a812f023e9d2c736e99cb9c7
MD5 hash:	707e7f6492429b89d52a665cb47d2e1f
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	general (ALT6).bat
File size:	3'399 bytes
SHA256 hash:	8ef1e5f6ae38a7a288ba1516293eda9183d7f265210897399f911d8a1e7e62fe
MD5 hash:	e6973238d03286140e2469f9616c9edc
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	README.md
File size:	20'578 bytes
SHA256 hash:	86fa594a19f25e5b911be7b88ab55549ef91e7eb9bb49b79c173be05ee8f365d
MD5 hash:	1ef74f2eaf734d0b552f0a6ebb3367f0
MIME type:	text/html
Signature	SalatStealer

File name:	tls_clienthello_max_ru.bin
File size:	664 bytes
SHA256 hash:	4ee0870abe0a0128600b0095189987ba1d210dae8bf963bc725aff49cf922624
MD5 hash:	b2b3e684ce449b60f0bc5a9028221a08
MIME type:	application/octet-stream
Signature	SalatStealer

File name:	general (ALT7).bat
File size:	3'158 bytes
SHA256 hash:	26b4dd29e5020066660230cf5ea61693dd85b69d15fc11ac967f3adf54fb352f
MD5 hash:	a8efa3ed6068b339fd86951c80e84c2f
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	general (ALT10).bat
File size:	3'564 bytes
SHA256 hash:	7a8b4d861c4448ee3fb4aef61d79bcdbfc3ea0ab043145f643539fbd177c8864
MD5 hash:	9a77b713dc626138ec7421f560716a28
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	general (SIMPLE FAKE).bat
File size:	3'554 bytes
SHA256 hash:	3d8bfbf6758e41c12d3e4975c451e20a92a0cf3a429e3c283d686b92172b2732
MD5 hash:	b37665df1f26cc7831732eca575a01e5
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	targets.txt
File size:	1'246 bytes
SHA256 hash:	4c953196e2649478c267450fc80cef121ef96bc50656ef75336b9589c0808cea
MD5 hash:	0260e9fef4eaf980bda2c0118c2693e1
MIME type:	text/plain
Signature	SalatStealer

File name:	general (FAKE TLS AUTO ALT).bat
File size:	3'762 bytes
SHA256 hash:	0a3744d9a42dd439b3576fa1d031d3d2ef6f93564bdb575a6afb0c8a3a056ac2
MD5 hash:	6545370a3d960f825186816b546b2bf2
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	tls_clienthello_www_google_com.bin
File size:	681 bytes
SHA256 hash:	936c2bee4cfb80aa3c426b2dcbcc834b3fbcd1adb17172959dc569c73a14275c
MD5 hash:	41e47557f16690df1781f67c8712714e
MIME type:	application/octet-stream
Signature	SalatStealer

File name:	general (FAKE TLS AUTO ALT3).bat
File size:	4'112 bytes
SHA256 hash:	7679e6f52ce95ed5c554de668286a40f2ac9b845cc69a3619a313f10e43cef46
MD5 hash:	3ca95fd9b8109cc6b154d90988f01321
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	ipset-exclude.txt
File size:	135 bytes
SHA256 hash:	96c03954012765ce4ab03b9c30f29ab1ca1b698c6752224d03828e6d182eb0fc
MD5 hash:	240532f20e114cd6de2906ebc86d683e
MIME type:	text/plain
Signature	SalatStealer

File name:	general (ALT4).bat
File size:	3'804 bytes
SHA256 hash:	feee3e7ecdbf3a5a46109b6018144954d793143ad4c889f3273f8ec1e8ac067d
MD5 hash:	1a9353401fc545311572880d32a88f78
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	general (FAKE TLS AUTO).bat
File size:	3'947 bytes
SHA256 hash:	fa227e6c9527b093d8099018b059c798f89e2984140fd903613e598a71b76276
MD5 hash:	4b09787d50d75067b8f7e9a95ef84748
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	list-exclude.txt
File size:	1'453 bytes
SHA256 hash:	cef044825cfc9e0f073cd040587e0bb2184d1cbb7a013ef6532da2cc34028de8
MD5 hash:	24c9a1a106d5ae764547dd6dd167ef2f
MIME type:	text/plain
Signature	SalatStealer

File name:	list-google.txt
File size:	414 bytes
SHA256 hash:	1e59f9d487f7bce12091c838151713d0a8d31c3aae20afefebb38206f2cd8232
MD5 hash:	a47c9cc57d60596de04f785df7384fb3
MIME type:	text/plain
Signature	SalatStealer

File name:	general (ALT11).bat
File size:	4'218 bytes
SHA256 hash:	8df459fc47b6becbfd4cc54263ab99ee275a62c8a8097fb4abea236e29e7cc85
MD5 hash:	81d21053303452399da6b09313cac0b3
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	LICENSE.txt
File size:	2'151 bytes
SHA256 hash:	8ea76af265366af6ef96595705ad21cafab82f2786203ae70d29a970260434dc
MD5 hash:	c503677f0456d501cad4eb9d8c84b6c7
MIME type:	text/plain
Signature	SalatStealer

File name:	list-general.txt
File size:	902 bytes
SHA256 hash:	9bcd915e90635562ad7332eab9b7e6ecce420ee344762423037ac6eff01d9dab
MD5 hash:	ca3279a7be4e68fc595c51fc63cb5194
MIME type:	text/plain
Signature	SalatStealer

File name:	quic_initial_www_google_com.bin
File size:	1'200 bytes
SHA256 hash:	f4589c57749f956bb30538197a521d7005f8b0a8723b4707e72405e51ddac50a
MD5 hash:	312526d39958d89b1f8ab67789ab985f
MIME type:	application/octet-stream
Signature	SalatStealer

File name:	general (ALT5).bat
File size:	2'176 bytes
SHA256 hash:	3e0a7026cccc02e6ca968dcd3efe4db94181cea190cecf4ac3e7e60d39d4dbb1
MD5 hash:	2d3d8bfe1a53bd8e0d03b8339fc02546
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	general (SIMPLE FAKE ALT).bat
File size:	3'734 bytes
SHA256 hash:	b9f847180ef1da5908870221acf03a469fc0dca87dadf7404350893d24ca02f2
MD5 hash:	6697b88f229fff35f241b32de084314f
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	general (ALT8).bat
File size:	3'455 bytes
SHA256 hash:	8612e0b0d5eb757448c4d2ef255abc00ff30f2b7e9087e0c936f7ba479af07e5
MD5 hash:	a2865133b7b6bc0adcc51acb7d64ae20
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	general (ALT).bat
File size:	3'794 bytes
SHA256 hash:	c6dff44ea3c7159788077e31a8e35929eab1c0270fb86f5490d44b1fd049a6fc
MD5 hash:	cadb63e600829d6d26aaac973d55d89d
MIME type:	text/x-msdos-batch
Signature	SalatStealer

File name:	service.bat
File size:	15'818'912 bytes
SHA256 hash:	cd6fda79a4abc4353b1946fe4ae4c27900b71d72dcba9f9a1aba9e4c1367dded
MD5 hash:	44fd91e5274856d604b8c1e556e214ab
MIME type:	text/x-msdos-batch
Signature	SalatStealer

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/8443bda0-a0c1-44f7-af02-2cfa3bf961b0/

Verdict:

Suspicious

Score:

50%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac1eab77521726fe3d75612

Tags:

shell sage

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/08ca4ac0b2ef5742ba956cac67c58d428142998ab8be88df1b105cea5702af8d

Verdict:

Adware

File Type:

rar

First seen:

2026-07-25T14:47:00Z UTC

Last seen:

2026-08-13T13:31:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/08ca4ac0b2ef5742ba956cac67c58d428142998ab8be88df1b105cea5702af8d/results?tab=lookup

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/08ca4ac0b2ef5742ba956cac67c58d428142998ab8be88df1b105cea5702af8d/

Threat name:

Script-BAT.Adware.Heuristic

Status:

Malicious

First seen:

2026-07-25 22:24:22 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

4 of 24 (16.67%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bdfevqfs55lufouvnswgprmnikaufgmkxc7irxy3cboouvycv6gq._file

Result

Malware family:

salatstealer

Score:

10/10

Tags:

family:salatstealer credential_access defense_evasion discovery execution spyware stealer trojan upx

Link:

https://tria.ge/reports/260811-xxvk3abn3v/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/08ca4ac0b2ef5742ba956cac67c58d428142998ab8be88df1b105cea5702af8d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample