⚠️ Overview

SalatStealer is a commodity information stealer malware first observed in December 2024 by researchers at ASEC (AhnLab Security Emergency Response Center) and subsequently analyzed by Broadcom’s Symantec Threat Hunter team. It is categorized as a stealer that targets browser credentials, cryptocurrency wallets, and session tokens, and is offered for sale on underground forums as a malware-as-a-service (MaaS) product by a developer known as “Salat.” The malware is written in C++ and uses public GitHub repositories for initial distribution and command-and-control (C2) communication.

🔧 Technical Capabilities

SalatStealer exfiltrates data from Google Chrome, Microsoft Edge, Brave, and other Chromium-based browsers, as well as from Firefox-based browsers, by parsing local SQLite databases and decrypting stored credentials using Windows DPAPI. It also targets cryptocurrency wallets including Bitcoin Core, Ethereum, Electrum, Exodus, and Monero by scanning standard wallet directory paths and modifying the Windows clipboard to replace copied wallet addresses with attacker-controlled addresses (clipboard hijacking). The malware uses a GitHub repository as its primary C2 channel, uploading stolen data as a file to a public repository via the GitHub API, and can also receive commands through GitHub releases. Persistence is achieved by adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun, and evasion techniques include checking for debugger or sandbox environments (e.g., detecting VMWare, VirtualBox, or Anubis) and delaying execution to avoid dynamic analysis. Propagation occurs via phishing emails containing malicious attachments or links, as well as through bundled downloads from shady websites.

📜 History & Notable Incidents

SalatStealer was first identified in December 2024 and has been actively used in campaigns primarily targeting Russian-speaking users, with victims reported in Russia, Ukraine, and neighboring countries. According to an ASEC report published on 2025-01-15, the malware was distributed via fake software cracking tools and game cheat downloads hosted on file-sharing platforms. No known CVEs are directly associated with SalatStealer; it relies on social engineering rather than exploiting system vulnerabilities. Law enforcement actions have not yet been reported against the SalatStealer developer or operators.

🔍 Detection Indicators

Known file hashes for SalatStealer samples include SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (reported by ASEC); additional hashes are listed in the ASEC blog entry. Network indicators include outbound HTTPS connections to api.github.com for data upload and raw.githubusercontent.com for retrieving C2 configuration files. Behavioral indicators include the creation of mutex named SalatStealerMutex and registry modifications under HKCU...RunSalatUpdater. The User-Agent string used by the stealer for GitHub API calls is SalatStealer/1.0 (Windows NT 10.0; Win64; x64).

☠️ Risk & Impact

SalatStealer poses a high risk to individual users and small organizations due to its ability to exfiltrate browser credentials, cryptocurrency wallet private keys, and session tokens, leading to account takeover, financial theft, and data breaches. Affected sectors include cryptocurrency investors, gaming communities, and general consumers who download pirated software. Financial losses are primarily from stolen cryptocurrency; the malware also facilitates identity fraud by stealing saved login credentials.

🛡️ Mitigation

To defend against SalatStealer, organizations should block execution of unsigned binaries downloaded from the internet, enable Windows Defender real-time protection with cloud-delivered protection, and implement application control policies that prevent unauthorized scripts and executables from running. Specific detection rules can be created by monitoring outbound HTTPS traffic to api.github.com and raw.githubusercontent.com from non-browser processes, and by disabling macro execution in Microsoft Office documents. Regular user awareness training on phishing and cracked software risks is also critical.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.