MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 44e1f2d7f258c67c7d18f6489f9e248a7bcbfc24ade4465b6b34678ee8af8c23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SalatStealer
Vendor detections: 11
| SHA256 hash: | 44e1f2d7f258c67c7d18f6489f9e248a7bcbfc24ade4465b6b34678ee8af8c23 |
|---|---|
| SHA3-384 hash: | f27496bbbb86969f44fdef08e5447f50e1da1e2753e0df9479a01b957789403ea3b4e671de8136fed8e071b19de486ec |
| SHA1 hash: | 02c2517fd490d7d086c6857d2b0b4ec12d942839 |
| MD5 hash: | ea98bfe6865707040a4fbcf93a5fadb9 |
| humanhash: | mockingbird-lactose-eighteen-hot |
| File name: | file |
| Download: | download sample |
| Signature | SalatStealer |
| File size: | 3'506'762 bytes |
| First seen: | 2026-02-01 00:49:06 UTC |
| Last seen: | 2026-02-01 01:39:03 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 40ab50289f7ef5fae60801f88d4541fc (59 x ValleyRAT, 49 x Gh0stRAT, 41 x OffLoader) |
| ssdeep | 49152:Y+MRdOHGd0kp+V7QqrV1Qncg1PiGn2KXoo4oJR3bptT7Fc54hSrffdFD8A5:YrLukpLUV1Dg1qGn2uHRHT7FI4hSZF75 |
| TLSH | T178F5F127B287E63EE45D0B3B05B2A26454FB6F61A523BD16D6F094ACCF350A01D3E607 |
| TrID | 62.3% (.EXE) Inno Setup installer (107240/4/30) 24.1% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 6.1% (.EXE) Win64 Executable (generic) (10522/11/4) 2.6% (.EXE) Win32 Executable (generic) (4504/4/1) 1.2% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| Magika | pebin |
| Reporter |  Bitsight |
| Tags: | dropped-by-amadey exe fbf543 SalatStealer |
Intelligence
File Origin
# of uploads :
12
# of downloads :
155
Origin country :
USVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Suspicious activity
Analysis date:
2026-02-01 00:50:20 UTC
Tags:
upx
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Verdict:
Malicious
Score:
97.4%
Tags:
extens obfusc overt
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug embarcadero_delphi fingerprint inno installer installer installer-heuristic packed soft-404
Verdict:
Malicious
Labled as:
Trojan.DOMG
Result
Gathering data
Malware family:
SalatStealer
Verdict:
Malicious
Score:
80%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Verdict:
Malicious
Threat:
Trojan.Win32.RokRat
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
7/10
Tags:
discovery installer upx
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Enumerates physical storage devices
System Location Discovery: System Language Discovery
UPX packed file
ACProtect 1.3x - 1.4x DLL software
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
44e1f2d7f258c67c7d18f6489f9e248a7bcbfc24ade4465b6b34678ee8af8c23
MD5 hash:
ea98bfe6865707040a4fbcf93a5fadb9
SHA1 hash:
02c2517fd490d7d086c6857d2b0b4ec12d942839
SH256 hash:
fa46c7ad2372fe42949f48af0286dec412c36d9e5f679f6e5aefc6896280b716
MD5 hash:
6adc7676b09e70c99334d6278302d416
SHA1 hash:
a3311f86ce3f2a7a9d2002868a4e8224685185d1
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Borland |
|---|---|
| Author: | malware-lu |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | MAL_packer_lb_was_detected |
|---|---|
| Author: | 0x0d4y |
| Description: | Detect the packer used by Lockbit4.0 |
| Rule name: | pe_detect_tls_callbacks |
|---|
| Rule name: | ProgramLanguage_Rust |
|---|---|
| Author: | albertzsigovits |
| Description: | Application written in Rust programming language |
| Rule name: | SEH__vectored |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | ThreadControl__Context |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Dropped by
Amadey
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.