🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52ae2bd23355fe6588ea888661de66d5a7f97802925706d7d0bcce544c8157a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SalatStealer


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52ae2bd23355fe6588ea888661de66d5a7f97802925706d7d0bcce544c8157a2
SHA3-384 hash: 76546f7cee7e7a72eb7e97458d7d77f9f56be0eb6579e24db1f20d545685d92e02f989b4486160e9a586c14d583e1ef7
SHA1 hash: da1349fd87272832a4ec5cec2e97f2ee86fb1943
MD5 hash: d6e22e721c0c93c299ab53eedb9f94e4
humanhash: wisconsin-hydrogen-december-solar
File name:t.bat
Download: download sample
Signature SalatStealer
Create hunting rule
File size:303 bytes
First seen:2025-11-19 19:09:09 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 6:s8GFPoSkaRvTihcWgG5efxTRQdWNYLkd8Y2F09uLgyKBM3S1R+jsbywFHhW6MFW:s8d5xAfj8/kd8v0oLgyaIS1IobDFHhNX
TLSH T1A8E0E7750303461057DC436D5419AD2A24707C0FC0567CD4F4C1A48C54DB382B7F446D
Magika powershell
Reporter smica83
Tags:bat SalatStealer UKR

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
t.bat
Verdict:
Suspicious activity
Analysis date:
2025-11-19 19:09:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f5ecb6aa-ab5a-45b0-83e4-0b1fc3c3a5ec

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/38718/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=691e15e740055a3d310dca48
Tags:
xtreme shell sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a file in the %AppData% subdirectories
Creating a file
Running batch commands
Using the Windows Management Instrumentation requests
Creating a process from a recently created file
Sending a UDP request
Creating a window
Blocking a possibility to launch for the Windows Task Manager (taskmgr)
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated powershell
Link:
https://www.filescan.io/uploads/691e15e40b3798286007d055/reports/49bbc6d2-f8af-48b8-822e-fc406d7b52b5/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/52ae2bd23355fe6588ea888661de66d5a7f97802925706d7d0bcce544c8157a2
Verdict:
Malicious
File Type:
ps1
First seen:
2025-11-19T16:55:00Z UTC
Last seen:
2025-11-19T18:23:00Z UTC
Hits:
~10
Detections:
Trojan.PowerShell.DefenderDisabler.sb HEUR:Trojan-PSW.Win32.Convagent.gen HEUR:Trojan-PSW.MSIL.Coins.gen Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Greedy.sb Trojan-PSW.Win32.Disco.sb Trojan-PSW.Win32.Coins.sb Trojan-PSW.MSIL.Stealer.sb Trojan-Dropper.Win32.Agent.sb Trojan.Win32.Agent.sb HEUR:Trojan.Java.Alien.gen Trojan-PSW.Win64.Salat.sb Trojan-PSW.Win32.HashCity.sb Trojan.Win32.Diztakun.sb
Link:
https://opentip.kaspersky.com/52ae2bd23355fe6588ea888661de66d5a7f97802925706d7d0bcce544c8157a2/results?tab=lookup
Result
Threat name:
Salat Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1817160
Signature
Antivirus detection for dropped file
Creates multiple autostart registry keys
Disable Task Manager(disabletaskmgr)
Disables the Windows task manager (taskmgr)
Disables Windows Defender (via service or powershell)
Drops PE files with benign system names
Exploit detected, runtime environment dropped PE file
Exploit detected, runtime environment starts unknown processes
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Modifies Windows Defender protection settings
Multi AV Scanner detection for dropped file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Defender Disable Scan Feature
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Processes Spawned by Java.EXE
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: System File Execution Location Anomaly
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Unusual module load detection (module proxying)
Uses cmd line tools excessively to alter registry or file data
Uses the Telegram API (likely for C&C communication)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Yara detected Salat Stealer
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1817160 Sample: t.bat Startdate: 19/11/2025 Architecture: WINDOWS Score: 100 106 api.telegram.org 2->106 108 release-assets.githubusercontent.com 2->108 110 4 other IPs or domains 2->110 124 Suricata IDS alerts for network traffic 2->124 126 Found malware configuration 2->126 128 Malicious sample detected (through community Yara rule) 2->128 132 20 other signatures 2->132 12 cmd.exe 1 2->12         started        15 1niPoOsiqpjIRIboXc.exe 2->15         started        18 dwm.exe 2->18         started        20 1niPoOsiqpjIRIboXc.exe 2->20         started        signatures3 130 Uses the Telegram API (likely for C&C communication) 106->130 process4 dnsIp5 154 Suspicious powershell command line found 12->154 156 Wscript starts Powershell (via cmd or directly) 12->156 22 powershell.exe 17 19 12->22         started        27 conhost.exe 12->27         started        122 172.67.190.135, 443, 54128 CLOUDFLARENETUS United States 15->122 158 Tries to harvest and steal browser information (history, passwords, etc) 15->158 160 Tries to steal Crypto Currency Wallets 15->160 signatures6 process7 dnsIp8 112 release-assets.githubusercontent.com 185.199.110.133, 443, 49690, 49691 FASTLYUS Netherlands 22->112 94 C:\Users\user\AppData\Local\Temp\filed.jar, Java 22->94 dropped 146 Found many strings related to Crypto-Wallets (likely being stolen) 22->146 29 javaw.exe 16 22->29         started        file9 signatures10 process11 file12 102 C:\Users\user\xD.jar, Zip 29->102 dropped 184 Uses cmd line tools excessively to alter registry or file data 29->184 186 Modifies Windows Defender protection settings 29->186 188 Disables Windows Defender (via service or powershell) 29->188 33 java.exe 21 29->33         started        38 reg.exe 1 1 29->38         started        40 powershell.exe 23 29->40         started        signatures13 process14 dnsIp15 104 api.telegram.org 149.154.167.220, 443, 49694, 49697 TELEGRAMRU United Kingdom 33->104 86 C:\Users\...\Updater681117287043426520.exe, PE32 33->86 dropped 88 C:\Users\...\Updater1574247982553973405.exe, PE32 33->88 dropped 90 C:\Users\...\Helper4060509198547342152.exe, PE32 33->90 dropped 92 2 other malicious files 33->92 dropped 134 Uses cmd line tools excessively to alter registry or file data 33->134 136 Modifies Windows Defender protection settings 33->136 138 Disables Windows Defender (via service or powershell) 33->138 42 Helper4060509198547342152.exe 33->42         started        47 Updater1574247982553973405.exe 33->47         started        49 Updater681117287043426520.exe 33->49         started        55 8 other processes 33->55 140 Disable Task Manager(disabletaskmgr) 38->140 142 Disables the Windows task manager (taskmgr) 38->142 51 conhost.exe 38->51         started        144 Loading BitLocker PowerShell Module 40->144 53 conhost.exe 40->53         started        file16 signatures17 process18 dnsIp19 114 dns.google 8.8.4.4, 443, 53446, 54127 GOOGLEUS United States 42->114 116 8.8.8.8, 443, 50771, 57209 GOOGLEUS United States 42->116 118 104.21.19.248, 443, 57211 CLOUDFLARENETUS United States 42->118 96 C:\Users\user\AppData\Local\...\dwm.exe, PE32 42->96 dropped 98 C:\...\1niPoOsiqpjIRIboXc.exe, PE32 42->98 dropped 162 Antivirus detection for dropped file 42->162 164 Multi AV Scanner detection for dropped file 42->164 166 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 42->166 182 3 other signatures 42->182 57 dwm.exe 42->57         started        168 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 47->168 170 Found many strings related to Crypto-Wallets (likely being stolen) 47->170 172 Queries memory information (via WMI often done to detect virtual machines) 47->172 60 WerFault.exe 47->60         started        62 WerFault.exe 49->62         started        120 ipv4.icanhazip.com 104.16.184.241, 443, 49720 CLOUDFLARENETUS United States 55->120 100 C:\Users\user\...\jna6488383705048912500.dll, PE32 55->100 dropped 174 Wscript starts Powershell (via cmd or directly) 55->174 176 Tries to harvest and steal browser information (history, passwords, etc) 55->176 178 Windows Scripting host queries suspicious COM object (likely to drop second stage) 55->178 180 Loading BitLocker PowerShell Module 55->180 64 powershell.exe 55->64         started        66 cmd.exe 55->66         started        68 powershell.exe 55->68         started        70 22 other processes 55->70 file20 signatures21 process22 signatures23 148 Antivirus detection for dropped file 57->148 150 Multi AV Scanner detection for dropped file 57->150 152 Loading BitLocker PowerShell Module 64->152 72 conhost.exe 66->72         started        74 timeout.exe 66->74         started        76 conhost.exe 68->76         started        78 conhost.exe 70->78         started        80 conhost.exe 70->80         started        82 conhost.exe 70->82         started        84 13 other processes 70->84 process24
Score:
92%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/52ae2bd23355fe6588ea888661de66d5a7f97802925706d7d0bcce544c8157a2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/52ae2bd23355fe6588ea888661de66d5a7f97802925706d7d0bcce544c8157a2/
Verdict:
Susipicious
Link:
https://tip.neiki.dev/file/52ae2bd23355fe6588ea888661de66d5a7f97802925706d7d0bcce544c8157a2
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kkxcxurtkx7glchkrcdgdxtg2wt7s6acsjlqnv6qxthfitebk6ra._file
Result
Malware family:
salatstealer
Create hunting rule
Score:
  10/10
Tags:
family:salatstealer credential_access defense_evasion discovery execution spyware stealer trojan upx
Link:
https://tria.ge/reports/251119-xty43ser6w/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Modifies registry class
Kills process with taskkill
Delays execution with timeout.exe
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Drops file in Windows directory
Drops file in Program Files directory
Checks for VirtualBox DLLs, possible anti-VM trick
ConfuserEx .NET packer
Drops file in System32 directory
Enumerates processes with tasklist
UPX packed file
Accesses cryptocurrency files/wallets, possible credential harvesting
Command and Scripting Interpreter: PowerShell
Legitimate hosting services abused for malware hosting/C2
Unsecured Credentials: Credentials In Files
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Loads dropped DLL
Executes dropped EXE
Checks computer location settings
Downloads MZ/PE file
Disables one or more Microsoft Defender components
Disables Task Manager via registry modification
Badlisted process makes network request
salatstealer
UAC bypass
Salatstealer family
Detect SalatStealer payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/52ae2bd23355fe6588ea888661de66d5a7f97802925706d7d0bcce544c8157a2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/38718/

Comments