ThreatFox: SalatStealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of SalatStealer malware by monitoring for matches against its specific set of 33 known Indicators of Compromise (IOCs). A SOC team should proactively hunt for these signals in Azure Sentinel to identify early-stage credential theft and data exfiltration activities that may evade standard signature-based detection.

IOC Summary

Malware Family: SalatStealer Total IOCs: 33 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`e7b8a37f2bb2238b7ce955e0bc3e97c8`	payload	2026-08-02	95%
sha256_hash	`042c76861bfba62c1e4946697a143a185488c0e15f41431c3cd5a51dc11e52a1`	payload	2026-08-02	95%
sha1_hash	`07139a197cb37cd7daf6cf6d17d7c738cc487f93`	payload	2026-08-02	95%
sha1_hash	`e728a6a5c5b29ea0e1355639a1ee577edf2eb443`	payload	2026-08-02	95%
md5_hash	`c85212d823d9412cb8eeec70e5145947`	payload	2026-08-02	95%
sha1_hash	`ae57744a0bb883a8ea831bfebfa0689371120baf`	payload	2026-08-02	95%
md5_hash	`d3fd162828ab54e5e860af9aaaeab41b`	payload	2026-08-02	95%
sha256_hash	`0ce366b7463e6b3c9d389d1c799c9b64219e71112f13568e5e16efbfbebf9da9`	payload	2026-08-02	95%
sha1_hash	`ef602380f15c5bb7aee218bf8c5ad42f2d4f0937`	payload	2026-08-02	95%
md5_hash	`810610e1e52c5b789bafea7d5d4e1ce2`	payload	2026-08-02	95%
sha256_hash	`bd283bdea40a7edcccaa1abc62a4b4c187cb5ff156e357bfcf9f7fd5f07462c4`	payload	2026-08-02	95%
sha1_hash	`82afcf65d159230d634a20dea703807f0f51efd0`	payload	2026-08-02	95%
md5_hash	`cc709b7dbbdab599842ab059df4a379c`	payload	2026-08-02	95%
sha256_hash	`93acec7eeff046efa957c819fed3c98eddcee365c276c62555a3f5ccb8a96a41`	payload	2026-08-02	95%
sha1_hash	`bf8e7181755cabed4958cd9508acfd9403fa6f0d`	payload	2026-08-02	95%
md5_hash	`1434d6d230e62adfc6f2a4d6f31d465c`	payload	2026-08-02	95%
sha256_hash	`7458f3a8146a5f731699d68e1ac3d4f3d87525b020852b0bf8454fb44c1c77c6`	payload	2026-08-02	95%
sha256_hash	`ab79affe31326c3a59b74a3aa4863207251deb7279f02d6177cf3a84031b2162`	payload	2026-08-02	95%
sha1_hash	`96ff9e92dc4d60b8f00d743e0d2614fbff612788`	payload	2026-08-02	95%
md5_hash	`4b81cbcc057d46aa660722301d59efb5`	payload	2026-08-02	95%
sha256_hash	`068fa74e4843dd0a7fd1488f262281e9b6b0e19d67eb8d52b20d63fda158fd3e`	payload	2026-08-02	95%
sha1_hash	`714575e8ddca56881959ea77028eb85e2543d736`	payload	2026-08-02	95%
md5_hash	`8b74529e0f62f2ec1d5d37758fc5d4db`	payload	2026-08-02	95%
md5_hash	`699a48056ea661dd446df61d4b107fa8`	payload	2026-08-02	95%
sha256_hash	`74b3cf6d93a3afdd46589c02250d99d4165b5a025acd60b62e4bc3fc4970a2a1`	payload	2026-08-02	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - SalatStealer
let malicious_hashes = dynamic(["e7b8a37f2bb2238b7ce955e0bc3e97c8", "042c76861bfba62c1e4946697a143a185488c0e15f41431c3cd5a51dc11e52a1", "07139a197cb37cd7daf6cf6d17d7c738cc487f93", "e728a6a5c5b29ea0e1355639a1ee577edf2eb443", "c85212d823d9412cb8eeec70e5145947", "ae57744a0bb883a8ea831bfebfa0689371120baf", "d3fd162828ab54e5e860af9aaaeab41b", "0ce366b7463e6b3c9d389d1c799c9b64219e71112f13568e5e16efbfbebf9da9", "ef602380f15c5bb7aee218bf8c5ad42f2d4f0937", "810610e1e52c5b789bafea7d5d4e1ce2", "bd283bdea40a7edcccaa1abc62a4b4c187cb5ff156e357bfcf9f7fd5f07462c4", "82afcf65d159230d634a20dea703807f0f51efd0", "cc709b7dbbdab599842ab059df4a379c", "93acec7eeff046efa957c819fed3c98eddcee365c276c62555a3f5ccb8a96a41", "bf8e7181755cabed4958cd9508acfd9403fa6f0d", "1434d6d230e62adfc6f2a4d6f31d465c", "7458f3a8146a5f731699d68e1ac3d4f3d87525b020852b0bf8454fb44c1c77c6", "ab79affe31326c3a59b74a3aa4863207251deb7279f02d6177cf3a84031b2162", "96ff9e92dc4d60b8f00d743e0d2614fbff612788", "4b81cbcc057d46aa660722301d59efb5", "068fa74e4843dd0a7fd1488f262281e9b6b0e19d67eb8d52b20d63fda158fd3e", "714575e8ddca56881959ea77028eb85e2543d736", "8b74529e0f62f2ec1d5d37758fc5d4db", "699a48056ea661dd446df61d4b107fa8", "74b3cf6d93a3afdd46589c02250d99d4165b5a025acd60b62e4bc3fc4970a2a1", "7261c4276f44e0ac3b2ef43ba4de223ce1278db20286750608777f41df0d68fd", "61a93e1deb3b225f54f8cb915a88c38ce5578d44", "5d073f25656f0f942bff1178c1a52404d63b2b17", "39888bfe023e44fdd4fa5b3ab616ebf8", "0603a9c2cc3efa9e1e6ca5f12d332d9f", "a11463bf176a39f72b5ab9c0e0401dbe0eb4be8d379b2d5fd5da21da0d2286e5", "58786663acbf0f9d7572aa61bb95cac9ca918c7732e9833e4b384c9ddc30c986", "0c1e182a7179a63bc79b649c42e0d78b11532201"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — SalatStealer

False Positive Guidance

False Positive Scenarios for “ThreatFox: SalatStealer IOCs” Rule

Scenario: Scheduled Backup Job Executing Hashed Artifacts
- Context: The enterprise’s nightly backup routine (e.g., Veeam or Commvault) scans and processes a large volume of user documents. If the backup engine utilizes a specific hashing algorithm or temporary staging directory that matches one of the 33 SalatStealer IOCs, it may trigger an alert when processing legitimate user files containing similar metadata signatures.
- Suggested Filter/Exclusion: Create a process exclusion for the backup service executable (e.g., Veeam.Backup.Service.exe or commvault.cmd) and exclude file paths within the designated backup staging directories (e.g., C:\ProgramData\Veeam\Backup\Staging).
Scenario: Endpoint Protection Scanning of Known Good Libraries
- Context: The organization’s endpoint detection and response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs deep scans on system libraries. During a scheduled update or integrity check, the EDR agent may flag legitimate DLLs within the System32 folder that share a specific cryptographic hash with the SalatStealer IOCs, particularly if the enterprise has customized these standard Windows components.
- Suggested Filter/Exclusion: Add an exclusion rule for the EDR service process (e.g., FalconSensorService.exe) specifically targeting the C:\Windows\System32 directory and whitelisting the specific SHA-256 hashes of known-good system libraries that match the IOC list.
Scenario: Admin Deployment via Configuration Management Tools
- Context: IT administrators use tools like SCCM (System Center Configuration Manager) or Ansible to deploy software updates across the fleet. During a mass deployment, the deployment