Hash match links mining-configured executable to dropped payload
Two sandbox reports identify a file dropped by the mining-configured executable as the same content separately analyzed with SalatStealer configuration. The match establishes a second component, while the analyses do not prove completed theft or a single reconstructed attack sequence.
An executable that configured Windows-update-themed launch settings also left a second program in a temporary cache directory. In two sandbox reports, that file—WinInetCache\g3.exe—had the exact SHA-256 of a separately analyzed executable with SalatStealer configuration. The relationship raises a more consequential question than either malware label alone: was this merely a mining-related program, or did its activity extend to placing another malware component on the host?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read