SalatStealer

Malware Family

1 724 indicators of compromise attributed to SalatStealer across abuse.ch threat intelligence feeds.

Domains

IPs

URLs

Hashes

1 697

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (6)IPs (9)URLs (12)Hashes (1 697)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

Indicator	Type
sa1atik.cn	domain
foenfispopka.live	domain
wruser.org	domain
salator.es	domain
websalat.top	domain
webrat.es	domain
193.221.200.26	ip
2.59.219.233	ip
185.213.240.179	ip
85.198.98.75	ip
176.12.71.122	ip
185.166.155.142	ip
64.204.180.24	ip
141.95.112.163	ip
109.237.98.213	ip
https://webrat.org/login/	url
https://salator.es/sa1at/s	url
https://wrat.in/sa1at/programfiles(x86)eprocessor_revision	url
https://websalat.top/sa1at/	url
https://webrat.top/login/	url
http://185.177.239.241:5001/renas.exe	url
https://rmp.computer/123.exe	url
https://oopz.surf/upd.exe	url
https://wruser.org/sa1at/	url
https://wruser.org:992/sa1at/	url
https://sa1atik.cn/sa1at/	url
https://salator.es/sa1at/	url
04ebd11564194c89d145cc891ab28b5ed20085882dca80949adcc749287226c1	hash
d3fd162828ab54e5e860af9aaaeab41b	hash
154b7e0a5540460c1c06d755a34403adf5e44a80ec840c9bd37416f8d0eab91c	hash
ab4e43a86948ffd778d81c5fc8d8d0b620d7d4cab09f659140715279a3be0da3	hash
13a3e7f3955eb52b9e281f191cbcb8cfd7a7c21f371df21246ce5106070541c9	hash
6155a7595b063d90fe9a643c3af022f7c350e27617122f9731d17d247216f39a	hash
a42d8d2ebb9cba2b4e65a82668e8f0f6c2883b06ebb240ddf15e9df839ebb016	hash
55f38fbe83519d49f46ba0a40c02a773d5a1e5195ba82435c54dfc73a43f7800	hash
16ed7ec55f1335bf311c85b7ec30c357d33d5c31588c7490dca4f3d8d4a3abfd	hash
3aa7183d6d223a343a79db110fa4735b74820c38ac123cbdf28e1481b1027d60	hash
568a732ae78c9ef36631997276b108f81a821cf0887578c4869a0b1cc193117f	hash
5df048aa57edebbce68fe0065c69092255368562aae200336083593c89f4a283	hash
f1eafc4a285f140f19786d791c624526ae8b348e	hash
93de66680b277c94cf8925ea36b9e396e6a57096f018f493edf64df898034dd0	hash
08f817d399bbad41fac3eee9a4df7c83b9eb30208b2aa55b69b05b0413c92ecc	hash
372bd07aaee454edd292edf4a2db37fc01edac319c4cb24bfd9c6e93a9148077	hash
12828d368f5aac41f4b583b3255e020e6c65a59bfe544fbac87a61cd0f0b5d1a	hash
2465bed844358af7061d4be23ef2411c80b40ac4d176bcbd5cf42d9491c7e40a	hash
6afe7971a072a9654969c152e420978cd54c2762a3e0ebad8518a8beae4ba89e	hash
108ea73955f776b6cebf6f22091f57e42bc2dcd7eb24b59c7d40f509d9aa8b9d	hash

Another file to check? Run a file hash reputation check.