TF-2013269
high
📛 Threat Title
SalatStealer: MD5 hash of a malware sample (payload) b3f2e844d7e939c4dcc6d690d3aefe7d
Description
Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: SalatStealer. Confidence: 95. First seen: 2026-11-03 16:42:24 UTC. Reporter: Grim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_md5
b3f2e844d7e939c4dcc6d690d3aefe7d
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/b3f2e844d7e939c4dcc6d690d3aefe7d
IOC database
- Type
- hash_md5
- Value
b3f2e844d7e939c4dcc6d690d3aefe7d- First seen
- Last seen
- Attached to this threat
- Appears in
- 3 threats
- Description
- URLhaus payload hash attributed to SalatStealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/b3f2e844d7e939c4dcc6d690d3aefe7d
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: SalatStealer. Confidence: 95. First seen: 2026-11-03 16:42:24 UTC. Reporter: Grim.
Remediations (10)
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as SalatStealer .
-
web:bazaar.abuse.ch
Malware samples associated with tag SalatStealer MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with SalatStealer . Database ...
-
web:cyberarmor.tech
Overview We recently identified a malware sample distributed through a YouTube video advertising a tool to "brute-force" or recover lost Bitcoin wallets. The lure is effective: it targets users who believe they can recover cryptocurrency, prompting them to execute an unknown binary. In reality, the payload is an infostealer, not a recovery tool. This blog documents the reverse engineering ...
-
web:cyberint.com
Introduction to SalatStealer Malware SalatStealer is a Go-based infostealer family first observed in August 2026, built for x86 Windows environments and focused on credential theft. Its documented capabilities include stealing authentication credentials, hiding executing code, and degrading security software. In the observed context, it appeared as a separate Windows stealer staged alongside a ...
-
web:github.com
The sample was obtained programmatically from Malware Bazaar via its authenticated API, selected for its combination of : SalatStealer family tag (new, previously unanalysed stealer family) UNIQ tag (unique file, not seen before in other campaigns) GCleaner delivery chain (known pay-per-install distribution) Same-day upload (first seen hours before analysis) The AES-encrypted zip was extracted ...
-
web:threatfox.abuse.ch
SalatStealer IOC: 4e64aa23b300582e68ea237d0e57cf73 ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash 4e64aa23b300582e68ea237d0e57cf73.
-
web:urlhaus.abuse.ch
URLhaus Database URLhaus tries to identify the malware associated with the payload served by a certain malware URL. In case URLhaus is able to identify the associated malware family, the payload will be tagged accordingly (field signature). The page below gives you an overview on payloads that URLhaus has identified as SalatStealer . Database Entry
-
web:www.cyfirma.com
Salat Stealer exemplifies the growing sophistication of Malware - as -a-Service ecosystems, blending advanced persistence, evasion, and data theft techniques with resilient C2 operations.
-
web:www.sonicwall.com
This week, SonicWall Capture Labs Threat Research Team analyzed a sample of SalatStealer . This is a Golang malware capable of infiltrating a system and enumerating through browsers, files, cryptowallets and systems while embedding a complete array of monitoring tools to push and pull any data on disk.
-
web:www.splunk.com
Learn how the Salat Stealer campaign uses Go-based surveillance and data exfiltration, and explore its infection chain and how to hunt for this threat using Splunk.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.