s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2013271 high

📛 Threat Title

SalatStealer: MD5 hash of a malware sample (payload) 04ccc50aea59cc73535267cc8315dba5

Category: SalatStealer Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: SalatStealer. Confidence: 95. First seen: 2026-11-03 16:42:25 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_md5 04ccc50aea59cc73535267cc8315dba5 VT 44 / 75

IOC database

Type
hash_md5
Value
04ccc50aea59cc73535267cc8315dba5
First seen
Last seen
Attached to this threat
Appears in
3 threats
Description
URLhaus payload hash attributed to SalatStealer

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 44 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win.Salat.R764049
ALYac malicious Dump:Generic.Dacic.18086.FD8F5403
APEX malicious Malicious
Arcabit malicious Dump:Generic.Dacic.18086.FD8F5403
Avast malicious Win32:Evo-gen [Trj]
AVG malicious Win32:Evo-gen [Trj]
Avira malicious TR/W32.Evo
BitDefender malicious Dump:Generic.Dacic.18086.FD8F5403
CrowdStrike malicious win/malicious_confidence_100% (D)
CTX malicious exe.unknown.dacic
Cylance malicious Unsafe
Cynet malicious Malicious (score: 100)
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.PWS.Salat.389
Elastic malicious malicious (moderate confidence)
Emsisoft malicious Dump:Generic.Dacic.18086.FD8F5403 (B)
ESET-NOD32 malicious WinGo/Agent.AXZ trojan
F-Secure malicious Trojan.TR/W32.Evo
Fortinet malicious W32/Agent.XS!tr
GData malicious Dump:Generic.Dacic.18086.FD8F5403
Google malicious Detected
huorong malicious Trojan/Agent.e!crit
Ikarus malicious Trojan.Win32.SalatStealer
K7AntiVirus malicious Trojan ( 005ce1d91 )
K7GW malicious Trojan ( 005ce1d91 )
Kaspersky malicious HEUR:Trojan-PSW.Win32.Convagent.gen
Kingsoft malicious malware.kb.b.858
Malwarebytes malicious Trojan.MalPack.Generic
MaxSecure malicious Trojan.Malware.300983.susgen
McAfeeD malicious Real Protect-LS!04CCC50AEA59
Microsoft malicious Trojan:Win32/Wacatac.B!ml
MicroWorld-eScan malicious Dump:Generic.Dacic.18086.FD8F5403
Rising malicious Stealer.Salat!1.13A22 (CLASSIC)
Sangfor malicious Trojan.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Sophos malicious Troj/Salat-B
Symantec malicious ML.Attribute.HighConfidence
TACHYON malicious Banker/W32.Agent.12572672.B
Tencent malicious Trojan.Win32.Stealer.16001830
Trapmine malicious malicious.high.ml.score
TrellixENS malicious Trojan-JBNR!E6DD4D7C6965
VIPRE malicious Dump:Generic.Dacic.18086.FD8F5403
Webroot malicious Win.Trojan.Gen
ZoneAlarm malicious Troj/Salat-B

Details From VirusTotal

Basic Properties
MD504ccc50aea59cc73535267cc8315dba5
SHA-1d112f9f31adffb08c4ddf4057d9e0b9aaf8c0873
SHA-2566ea8d738dd5d1d4b665daf5de978a3d5535fd4ec4932fa93d5cadf85b14d04b6
VHash03603e0f7d1bz4!z
SSDEEP98304:SvZJpEwbceOJn6nRMhERASjTz8LQj8ZJIS0r6:QpEgOJn6nRMhERA280j8ZJh0
TLSHT139F53321A063CCECF7A47A328DCE55D709CC2DA73FF744359E539461AAA44E684D238B
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
File size3.4 MB
History
First seen on VirusTotal2026-11-02 10:52 UTC
Last submission2026-11-02 10:52 UTC
Last analysis2026-11-02 10:52 UTC
Last modified on VirusTotal2026-11-03 01:03 UTC
Known Names
  • c66e5c31-0156-424b-ab9d-d3e11f497c55
  • b96ad1da-9391-4f17-8634-f3d3cd6e959f
  • f3f2e388-f2a4-4547-b442-339e844e142c
  • f5e89cbc-6659-4d72-b76a-7f5dc2dfade1
  • 45a8c1bd-d17b-4a49-8a0c-ad8c6fb5b720
  • 60eb93c6-36ac-44e0-8afb-2e70e0e3ccae
  • 0f2e3324-24c4-4a4b-8710-d59e518897bf
  • fa7a020d-748a-4257-ac42-f472557ec3ba
  • 5be96e95-a35d-4e37-a803-328801cadb13
  • b3d4f92f-5e0e-400c-8008-deaf754100d9
  • ab10fd81-3915-4f3d-9f0e-815b29ba217a
  • c8836e44-01fc-4713-93e3-a77869855d91
  • fe525c1a-3363-4fa2-9ddb-f58a21098f92
  • 5824b018-8a8d-41c8-ab2f-088e1b424471
  • 17d686fb-2b06-4815-b45f-17d155d74bac
  • 7e5018e9-0709-4920-96b6-1450c0cde5a1
  • 6ab6eee3-b27a-4d9b-ad10-cdc3d922fae0
  • 825f472e-2ced-4236-aa29-579ec0a50da9
  • 975cd6c7-4f1b-4e91-a344-f720478d777c
  • faa45f5c-a329-4458-9179-0d38110c8df6
  • 734ea7e8-df6d-4ced-929b-8d71ae123709
  • b18632b3-548d-47ed-957b-9b461152262a
  • 7kqfroebo.exe
  • v2RayTun_Setup.exe

References (2)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: SalatStealer. Confidence: 95. First seen: 2026-11-03 16:42:25 UTC. Reporter: Grim.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.