SALATSTEALER

MITRE ATT&CK Mapping Tactic Technique ID Implementation Initial Access Phishing: Spearphishing Link T1566.002 Cracked software download links

On execution: mutex check ( checkDupe ), UAC bypass ( Elevate ), persistence via registry Run key and Task Scheduler...

the threat actor leverages PowerShell, BITSAdmin, and lightweight obfuscation techniques to stage and deploy SalatStealer

the threat actor leverages PowerShell, BITSAdmin, and lightweight obfuscation techniques to stage and deploy SalatStealer

This campaign demonstrates how ClickFix-style social engineering continues to evolve through abuse of legitimate Windows tooling and user-assisted execution workflows.

On execution: mutex check ( checkDupe ), UAC bypass ( Elevate ), persistence via registry Run key and Task Scheduler...

MITRE ATT&CK Mapping Technique ID Implementation Modify Registry T1112 Registry Run key persistence, Defender exclusion bypass

the threat actor leverages PowerShell, BITSAdmin, and lightweight obfuscation techniques to stage and deploy SalatStealer

On execution: mutex check ( checkDupe ), UAC bypass ( Elevate ), persistence via registry Run key and Task Scheduler...

On execution: mutex check ( checkDupe ), UAC bypass ( Elevate ), persistence via registry Run key and Task Scheduler...

MITRE ATT&CK Mapping Technique ID Implementation ... Process Injection T1055 WriteProcessMemory , SetWindowsHookEx

main.DuplicateUserTokenFromSessionID -- WTS token duplication main.getSystemToken -- SYSTEM token acquisition

main.DuplicateUserTokenFromSessionID -- WTS token duplication main.getSystemToken -- SYSTEM token acquisition

On execution: mutex check ( checkDupe ), UAC bypass ( Elevate ), persistence via registry Run key and Task Scheduler...

Privilege Escalation main.Elevate -- UAC bypass ... Collection hits ... then privilege escalation through IElevator COM, token duplication, and LSASS handle enumeration.

the threat actor leverages PowerShell, BITSAdmin, and lightweight obfuscation techniques to stage and deploy SalatStealer

MITRE ATT&CK Mapping Technique ID Implementation ... Process Injection T1055 WriteProcessMemory , SetWindowsHookEx

Cleanup via selfDelete() and remote Suicide() command.

main.DuplicateUserTokenFromSessionID -- WTS token duplication main.getSystemToken -- SYSTEM token acquisition

main.DuplicateUserTokenFromSessionID -- WTS token duplication main.getSystemToken -- SYSTEM token acquisition

the threat actor leverages PowerShell, BITSAdmin, and lightweight obfuscation techniques to stage and deploy SalatStealer

MITRE ATT&CK Mapping Technique ID Implementation Virtualization/Sandbox Evasion T1497 VirtualBox/VMware registry key checks, ACPI enumeration

MITRE ATT&CK Mapping Technique ID Implementation Modify Registry T1112 Registry Run key persistence, Defender exclusion bypass

main.NtQuerySystemHandles -- Handle enumeration (LSASS targeting) main.findLsassProcess -- LSASS process location

main.runKeylogger -- Start capture main.keyPressCallback -- SetWindowsHookEx WH_KEYBOARD callback main.windowChangeCallback -- Active window change (context labeling)

Collection hits 34 browsers, 28 crypto wallets, Telegram/Discord/Steam tokens, keylogger with window context, screenshots, and clipboard.

The malware’s extensive browser and cryptocurrency wallet targeting highlights the continued operational focus on credential theft, session hijacking, and digital asset compromise.

MITRE ATT&CK Mapping Technique ID Implementation Credentials in Files T1552.001 Browser profile data, wallet files

The malware’s extensive browser and cryptocurrency wallet targeting highlights the continued operational focus on credential theft, session hijacking, and digital asset compromise.

Firefox gets parallel treatment through NSS master key derivation with ASN.1 PBE parsing, 3DES and AES decryption paths, and proper PKCS5 unpadding.

Chromium-based browsers get the full treatment: DPAPI master key decryption, AES-GCM cookie/password decryption, and -- critically -- a GetAppBoundKey function that bypasses Chrome v127+'s App-Bound Encryption via the IElevator COM interface.

MITRE ATT&CK Mapping ... Process Discovery T1057 PROCESSENTRY32 enumeration

MITRE ATT&CK Mapping Technique ID Implementation System Information Discovery T1082 Win32_Processor , Win32_LogonSession , HWID

MITRE ATT&CK Mapping Technique ID Implementation Virtualization/Sandbox Evasion T1497 VirtualBox/VMware registry key checks, ACPI enumeration

The bc.exe filename observed in a second Triage submission suggests the binary is distributed under different names to affiliates. System language and location discovery TTPs in that submission indicate geo-targeting or geo-fencing behavior.

The bc.exe filename observed in a second Triage submission suggests the binary is distributed under different names to affiliates. System language and location discovery TTPs in that submission indicate geo-targeting or geo-fencing behavior.

MITRE ATT&CK Mapping Technique ID Implementation ... Data from Local System T1005 Wallet files, Telegram tdata, Steam configs

main.runKeylogger -- Start capture main.keyPressCallback -- SetWindowsHookEx WH_KEYBOARD callback main.windowChangeCallback -- Active window change (context labeling)

main.(*wsSess).ffdesktop -- Real-time screen streaming via ffmpeg

Collection hits 34 browsers, 28 crypto wallets, Telegram/Discord/Steam tokens, keylogger with window context, screenshots, and clipboard.

Capability Functions Method ... Microphone ffwmic , getMics ffmpeg

main.(*wsSess).ffwcam -- Webcam capture

The transport layer uses gorilla/websocket over HTTPS with QUIC/HTTP3 support (via quic-go). The C2 path is /saat/ with a WebSocket session protocol ( wsSess ) for bidirectional command execution.

Every infected host becomes a SOCKS5 proxy node: main.(*socks5Conn).Serve -- SOCKS5 server ... main.p2pSocks -- P2P SOCKS relay

The actual C2 connection uses WebSocket over TLS for command-and-control, and QUIC (HTTP/3) for bulk data exfiltration.

the threat actor leverages PowerShell, BITSAdmin, and lightweight obfuscation techniques to stage and deploy SalatStealer

SalatStealer has been documented before ... The binary imports github.com/xssnick/tonutils-go v1.16.0 and implements two functions: main.tonResolve and main.tryTonResolve.

A tloop function implements a polling loop that periodically re-resolves via TON, meaning the operator can rotate infrastructure mid-campaign and all infected hosts will follow within one polling interval. This is Fast Flux DNS with the blockchain as the authoritative server.

The actual C2 connection uses WebSocket over TLS for command-and-control...

Exfiltration compresses to sent.zip , ships over WSS and QUIC.