MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 796442361ec0029fc72ebf3fc4b67c69a4ed8214cce213602bff08e6bdfd3049. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SalatStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 796442361ec0029fc72ebf3fc4b67c69a4ed8214cce213602bff08e6bdfd3049
SHA3-384 hash: 2dad400650133a8d89c1357c168fad15b111781d71f4fe7cfbe9a077d922c336893fe87cf0b56afa035baa2e5ca8f95d
SHA1 hash: bf8f8f6e4fd5898e4fb19966633fa4df745a0665
MD5 hash: 0d03a3817d5b742f57d943dce6e01dc4
humanhash: colorado-autumn-mango-alaska
File name:xeno.exe
Download: download sample
Signature SalatStealer
Create hunting rule
File size:10'632'550 bytes
First seen:2026-08-22 15:37:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b4ffb48d11b2e166e1827eae65cb86c6 (1 x SalatStealer)
ssdeep 196608:l1OUb0B/vI4nO38Ox2UW7Bo19hC/PXf2JTE87OHvORz0hrxqq:lQ3I4nC2UWChePOtx7qhd
TLSH T1C7B633335003AD2EDC3694F863726F624C430E6CE46A66455AF9F81AF1E76634F2D2D2
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon 107262e6b8f0c881 (1 x SalatStealer)
Reporter Alex_sev
Tags:exe Generic kryptik SalatStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
IR IR
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/d2a7db07-d318-49e9-9e4b-5be03fff2d28/
Detection:
Salat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/82502/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a process with a hidden window
Creating a window
Сreating synchronization primitives
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Sending a UDP request
Creating a file in the Program Files subdirectories
Deleting a recently created file
Launching a process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed packed
Link:
https://www.filescan.io/uploads/6a89c265904c611dfbc90cfe/reports/1175ca8a-40b4-4706-974a-9f6c35b72455/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/796442361ec0029fc72ebf3fc4b67c69a4ed8214cce213602bff08e6bdfd3049
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/620e2fac-a2ae-43a2-9ceb-741ac81ec73c
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/796442361ec0029fc72ebf3fc4b67c69a4ed8214cce213602bff08e6bdfd3049
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/0d03a3817d5b742f57d943dce6e01dc4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/796442361ec0029fc72ebf3fc4b67c69a4ed8214cce213602bff08e6bdfd3049/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pfseenq6yabj7rzox474jnt4ngso3aquztrbgybl74eonpp5gbeq._file
Result
Malware family:
salatstealer
Create hunting rule
Score:
  10/10
Tags:
family:salatstealer credential_access defense_evasion discovery execution persistence spyware stealer upx
Link:
https://tria.ge/reports/260822-s25vdawcjb/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
UPX packed file
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Executes dropped EXE
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Command and Scripting Interpreter: PowerShell
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Detect SalatStealer payload
Family: salatstealer
Unpacked files
SH256 hash:
796442361ec0029fc72ebf3fc4b67c69a4ed8214cce213602bff08e6bdfd3049
MD5 hash:
0d03a3817d5b742f57d943dce6e01dc4
SHA1 hash:
bf8f8f6e4fd5898e4fb19966633fa4df745a0665
Link:
https://www.unpac.me/results/036f5888-6677-4b94-809d-c4afedd0acec/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/82502/

Comments