ThreatFox: SalatStealer IOCs

Hunt Hypothesis

This detection rule identifies potential SalatStealer activity by monitoring network and host logs against a curated set of 73 known indicators of compromise specific to this information stealer malware. Proactively hunting for these IOCs in Azure Sentinel is critical due to the high severity risk posed by SalatStealer’s ability to exfiltrate sensitive credentials and financial data, enabling early containment before widespread impact occurs.

IOC Summary

Malware Family: SalatStealer Total IOCs: 73 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`a3a4f47b5f80bf063630354d7f03210bc2ad27ad`	payload	2026-07-25	95%
md5_hash	`dcfa838bccb8d683e124b106fdb8a75b`	payload	2026-07-25	95%
sha1_hash	`bb7417b595c0a11330d3fa73a1a252743171b014`	payload	2026-07-25	95%
md5_hash	`24338d2e35bd0bf40aee61ed5f54b48a`	payload	2026-07-25	95%
sha256_hash	`004ee466e951b32eaf7d0e611050efb1d9f9261c64d69ffc9d8c6a84836fc365`	payload	2026-07-25	95%
sha1_hash	`2546041339221f6fed8ef9e6645b509b1703e1f8`	payload	2026-07-25	95%
md5_hash	`154776e2ade2e0ef31b5e2752f30f6b4`	payload	2026-07-25	95%
sha256_hash	`005fa4606e1c5f4e382a302d5da1a00a8204316848a2fa7e58600b2faa52f12a`	payload	2026-07-25	95%
md5_hash	`04e0c05f989f7f60892b0c1670dd9ca1`	payload	2026-07-25	95%
sha256_hash	`00cb8d48f2571613e9bd7e9ef93986009cb5c075a9079f10d274910128f5bd40`	payload	2026-07-25	95%
md5_hash	`b570ca54a362a61ad5237681c90e1523`	payload	2026-07-25	95%
sha256_hash	`007256dae6b6239ab6774958cbac6ceae190df52278bc66e18ed05764be811c4`	payload	2026-07-25	95%
sha1_hash	`643ea8c1b966e2987714187867e2c664ed54e7cb`	payload	2026-07-25	95%
md5_hash	`534e81996c3cc467ac4441170608b58e`	payload	2026-07-25	95%
sha256_hash	`00dc46d870422064f4f0570db6774034349e5927eb32d0d1b784475d2f77294a`	payload	2026-07-25	95%
sha1_hash	`0f775839b75fa9f00a671526912b1f37224c2309`	payload	2026-07-25	95%
sha1_hash	`008d5b3a18717ab342553380be3b4e058e69fa73`	payload	2026-07-25	95%
md5_hash	`e5ca659a13cad28aae3f8494f600d74c`	payload	2026-07-25	95%
sha256_hash	`00e5c871d833b8b97bb7401591044dd92a52c20207e2f693d99e9175c9ef7e28`	payload	2026-07-25	95%
sha1_hash	`7efc420a311633cfd04c53d3d6b82c48a961e28f`	payload	2026-07-25	95%
md5_hash	`77307555f8d4076fe040ddc0ab1f0fea`	payload	2026-07-25	95%
sha256_hash	`01b5e2711d157c6aec9a981bd3f74d9153aef5789f3463e3de472e4cf05ca990`	payload	2026-07-25	95%
sha1_hash	`a3bcd9a3d387c7be8ae15aa5a2e71e0853a13ee5`	payload	2026-07-25	95%
md5_hash	`30d0e8c5d3deac9607282a0c49bd1cf2`	payload	2026-07-25	95%
sha256_hash	`53030654fbe1aef7d34abb151ac5725291f9a880d1fa2ee5b174445abfab6d58`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - SalatStealer
let malicious_hashes = dynamic(["a3a4f47b5f80bf063630354d7f03210bc2ad27ad", "dcfa838bccb8d683e124b106fdb8a75b", "bb7417b595c0a11330d3fa73a1a252743171b014", "24338d2e35bd0bf40aee61ed5f54b48a", "004ee466e951b32eaf7d0e611050efb1d9f9261c64d69ffc9d8c6a84836fc365", "2546041339221f6fed8ef9e6645b509b1703e1f8", "154776e2ade2e0ef31b5e2752f30f6b4", "005fa4606e1c5f4e382a302d5da1a00a8204316848a2fa7e58600b2faa52f12a", "04e0c05f989f7f60892b0c1670dd9ca1", "00cb8d48f2571613e9bd7e9ef93986009cb5c075a9079f10d274910128f5bd40", "b570ca54a362a61ad5237681c90e1523", "007256dae6b6239ab6774958cbac6ceae190df52278bc66e18ed05764be811c4", "643ea8c1b966e2987714187867e2c664ed54e7cb", "534e81996c3cc467ac4441170608b58e", "00dc46d870422064f4f0570db6774034349e5927eb32d0d1b784475d2f77294a", "0f775839b75fa9f00a671526912b1f37224c2309", "008d5b3a18717ab342553380be3b4e058e69fa73", "e5ca659a13cad28aae3f8494f600d74c", "00e5c871d833b8b97bb7401591044dd92a52c20207e2f693d99e9175c9ef7e28", "7efc420a311633cfd04c53d3d6b82c48a961e28f", "77307555f8d4076fe040ddc0ab1f0fea", "01b5e2711d157c6aec9a981bd3f74d9153aef5789f3463e3de472e4cf05ca990", "a3bcd9a3d387c7be8ae15aa5a2e71e0853a13ee5", "30d0e8c5d3deac9607282a0c49bd1cf2", "53030654fbe1aef7d34abb151ac5725291f9a880d1fa2ee5b174445abfab6d58", "bcf403c073cfafcb22c364ae8e5bcc595437a4a2", "abe1f41e3fd3c7e3dbcc986426f694dd", "1fbeebd50284ce6fa42e48fcd3a36a8b27ee0a2f1b9ff8b4674f5bcdf4549ad7", "00eca1a382560f46f042bcc2fd972dddca20768d3ec13448f5d43bf5d5f54002", "cdf1bd4877feb374a146ae2015089735672ae3cd", "d33e96d3fab0ef6266c645266c1312d0", "9122a7ce2c76efdd19d5670b6eb33ae5bf06ba01", "e63c4d2932bba77476fc82814d696bce1caf337d", "fa80df233f896120abded61035b868ec", "d9caf6b0f7220657c8ebd40ee6e8a20ce2ff71b977d99553c3db0b59bb0eaad9", "54b0598d70827bcb1204454561f139a07a5aebfd", "11b0e224ad2108cc24be3918299c2c3e", "fbf4ef28c4b49c6304d23a738afabf8981590eae8585834bf24e3c7e87163c1a", "08161e05c4971e5a566f534a6690cbf8a42470744855524834bd510b6229c172", "61c777c5071c8264412fe317f30e5c493ac7cc76", "b4a65477542b3799b10940edaca3067e", "a0c5ebaa47f0cf3d8cd695d66b8c5e5561afd30da1b2f4d73f3736dca35efba7", "2cbd66cd62b31653845333003ef13dcfc8bef529", "e811e3e6d9e7ba41c7cd64e4d24999ea", "66a8114ae85628bf639b01fc3ce7e02a42baf356", "a77d976fbff17ce256e18d5ad1935c48", "e2da32f62c86eea0510dba268c1bd5a51e7bd6dd869a70089da2fa292e325e71", "f4c635ed4761ec8bf5f0b2355afee43110093952eb2b13441b64ac1a93bfbc40", "7bd71cc73d62bc6671436952e8e356e0a505fd08", "e7b0885f84c96d3d3c5a133f6406d678"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — SalatStealer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: SalatStealer IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Endpoint Protection Scanning via Scheduled Tasks
- Context: Enterprise EDR solutions (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) often run scheduled scans that extract and analyze specific IOCs from threat intelligence feeds. If the “SalatStealer” feed is integrated into the EDR’s local database, the scanning engine may generate network or file access events matching the 73 IOCs during its nightly maintenance window (e.g., 02:00 AM).
- Filter/Exclusion: Create an exclusion based on the Process Name of the EDR service (e.g., C:\Program Files\CrowdStrike\fs_qrte.exe or C:\Windows\System32\MsMpEng.exe) and restrict it to a specific Time Window (e.g., 01:00–04:00 local time).
Scenario: Automated Threat Intelligence Feed Ingestion by SIEM
- Context: The organization’s SIEM (e.g., Splunk or Elastic Security) runs an automated job to ingest daily threat intelligence updates. During the ingestion process, the parser may log network connections or file reads against the raw IOC list of SalatStealer as it validates and indexes the new data before distributing it to endpoints.
- Filter/Exclusion: Exclude events where the Source Host matches the internal SIEM collector IP range (e.g., 10.20.50.x) or filter by Process Command Line containing keywords like “feed_ingestion” or “threat_intel_update”.
Scenario: Security Analyst Manual Investigation using Threat Intelligence Platforms *