2026-10-02_a892a26bd73964e05cb3d412406c0518_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch
Salat RAT stealer detected
Go stealer targets browser keys, wallets, Telegram, and inputSalat Stealer RAT family indicators
SHA-256aec07ef1c0ec369e3b33199b5d929674b5d3ddb38d610247fd3749f9d7a4270c
Evidence
0x539b436d20737472696e67207d00252a66756em string }.%*fun
0x539b536328737472696e672920287379732e53c(string) (sys.S
0x539b637461745f742c207379732e4572726e6ftat_t, sys.Errno
0x539b732900252a66756e6328737472696e672c).%*func(string,
0x539b8320696e7436342c20696e743634292073 int64, int64) s
0x539b9379732e4572726e6f00252a7374727563ys.Errno.%*struc
0x539ba374207b206b65792064776172662e4174t { key dwarf.At
0x539bb374723b20656c656d20626f6f6c207d00tr; elem bool }.
0x539bc3262a737472756374207b20456e747279&*struct { Entry
0x539bd353616c74205b5d75696e74383b204c65Salt []uint8; Le
0x539be36e20696e74207d00262a737472756374n int }.&*struct
0x539bf3207b20546f74616c506879736963616c { TotalPhysical
0x539c034d656d6f727920737472696e67207d00Memory string }.
0x539c13262a66756e632873797363616c6c2e48&*func(syscall.H
0x539c23616e646c652c2075696e747074722920andle, uintptr)
0x539c3375696e7470747200262a737472756374uintptr.&*struct
0x539c43207b206b657920783530392e73756d32 { key x509.sum2
0x539c5332343b20656c656d20626f6f6c207d0024; elem bool }.
0x539c63262a5b385d737472756374207b206b65&*[8]struct { ke
0x539c737920737472696e673b20656c656d2073y string; elem s
0x539c837472696e67207d00262a737472756374tring }.&*struct
0x539c93207b206b657920737472696e673b2065 { key string; e
0x539ca36c656d20737472756374207b7d207d00lem struct {} }.
0x539cb3262a737472756374207b20462075696e&*struct { F uin
0x539cc3747074723b205830202a6d61696e2e77tptr; X0 *main.w
0x539cd37353657373207d000000000000040000sSess }.........
0x539ce3000400000079c4 .....y.
0x5503c5000000e8e19eee020404330000000004..........3.....
0x5503d5b93b011a670400000000000200020040.;..g..........@
0x5503e5b30701809f070140a20701e03d0a0100.......@....=...
0x5503f5326769746875622e636f6d2f746574722github.com/tetr
0x5504056174656c6162732f77617a65726f2f69atelabs/wazero/i
0x5504156e7465726e616c2f7761736d72756e74nternal/wasmrunt
0x550425696d650314417070426f756e64456e63ime..AppBoundEnc
0x5504357279707465644b65791e6a736f6e3a22ryptedKey.json:"
0x5504456170705f626f756e645f656e63727970app_bound_encryp
0x5504557465645f6b65792200332a7374727563ted_key".3*struc
0x55046574207b20462075696e747074723b2058t { F uintptr; X
0x55047530202a6d61696e2e7773536573733b200 *main.wsSess;
0x5504855831205b5d737472696e67207d00332aX1 []string }.3*
0x5504955b305d2a676f2e73686170652e737472[0]*go.shape.str
0x5504a5756374207b20696e7465726e616c2f73uct { internal/s
0x5504b5796e632e6973456e74727920626f6f6cync.isEntry bool
0x5504c5207d00332a5b385d737472756374207b }.3*[8]struct {
0x5504d5206b657920636f6e746578742e63616e key context.can
0x5504e563656c65723b20656c656d2073747275celer; elem stru
0x5504f56374207b7d207d00332a5b5d73747275ct {} }.3*[]stru
0x5505056374207b206b65792075696e7431363bct { key uint16;
0x55051520656c656d2066756e632829202a6870 elem func() *hp
0x5505256b652e686b64664b4446207d00332a5bke.hkdfKDF }.3*[
0x550535385d737472756374207b206b6579206e8]struct { key n
0x55054565742e686f73744c6f6f6b75704f7264et.hostLookupOrd
0x55055565723b20656c65 er; ele
0x5ea9ea73457857496d706572736f6e6174654csExWImpersonateL
0x5ea9fa6f676765644f6e55736572436f696e6foggedOnUserCoino
0x5eaa0a6d695c436f696e6f6d695c77616c6c65mi\Coinomi\walle
0x5eaa1a74734c6f63616c5c54686f7269756d5ctsLocal\Thorium\
0x5eaa2a5573657220446174614c6f63616c5c49User DataLocal\I
0x5eaa3a72696469756d5c557365722044617461ridium\User Data
0x5eaa4a4c6f63616c5c566976616c64695c5573Local\Vivaldi\Us
0x5eaa5a657220446174614c6f63616c5c4f7262er DataLocal\Orb
0x5eaa6a6974756d5c5573657220446174614c6fitum\User DataLo
0x5eaa7a63616c5c4b2d4d656c6f6e5c55736572cal\K-Melon\User
0x5eaa8a20446174614c6f63616c5c536c696d6a DataLocal\Slimj
0x5eaa9a65745c557365722044617461454e4450et\User DataENDP
0x5eaaaa4f494e542053454c454354494f4e204cOINT SELECTION L
0x5eaaba4f4f505c54656c656772616d20446573OOP\Telegram Des
0x5eaaca6b746f705c7464617461436c69656e74ktop\tdataClient
0x5eaada735c537465616d546f6b656e732e7478s\SteamTokens.tx
0x5eaaea746d61696e3a20696e76616c69642073tmain: invalid s
0x5eaafa69676e617475726570726f6365737369ignatureprocessi
0x5eab0a6e6720636f6f6b6965732066726f6d66ng cookies fromf
0x5eab1a61696c656420746f2072656164206669ailed to read fi
0x5eab2a6c653a2025766465636f64652041534ele: %vdecode ASN
0x5eab3a312064617461206661696c65647a69701 data failedzip
0x5eab4a3a20696e7365637572652066696c6520: insecure file
0x5eab5a706174687a69703a2077726974652074pathzip: write t
0x5eab6a6f206469726563746f72796279746573o directorybytes
0x5eab7a2e4275666665723a20746f6f206c6172.Buffer: too lar
0x5eab8a6765756e737570706f72746564206365geunsupported ce
0x5eab9a7274696669636174656e6f206170706crtificateno appl
0x5eabaa69636174696f6e2070726f746f636f6cication protocol
0x5eabba6563682061636365707420636f6e6669ech accept confi
0x5eabca726d6174696f6e rmation
0x5f13dc6d6178207061676573203d2072756e74max pages = runt
0x5f13ec696d653a206c6576656c53686966745bime: levelShift[
0x5f13fc6c6576656c5d203d20646f5265636f72level] = doRecor
0x5f140c64476f726f7574696e6550726f66696cdGoroutineProfil
0x5f141c65206770313d4e744372656174655761e gp1=NtCreateWa
0x5f142c6974436f6d706c6574696f6e5061636bitCompletionPack
0x5f143c6574004e7443616e63656c5761697443et.NtCancelWaitC
0x5f144c6f6d706c6574696f6e5061636b657400ompletionPacket.
0x5f145c74696d65426567696e2f456e64506572timeBegin/EndPer
0x5f146c696f64206e6f7420666f756e6472756eiod not foundrun
0x5f147c74696d653a207375646f672077697468time: sudog with
0x5f148c206e6f6e2d6e696c2063656e74657273 non-nil centers
0x5f149c797363616c6c20696e636f6e73697374yscall inconsist
0x5f14ac656e7420627020656e74657273797363ent bp entersysc
0x5f14bc616c6c20696e636f6e73697374656e74all inconsistent
0x5f14cc2073702067667075743a206261642073 sp gfput: bad s
0x5f14dc746174757320286e6f74204764656164tatus (not Gdead
0x5f14ec294c6f636b4f53546872656164206e65)LockOSThread ne
0x5f14fc7374696e67206f766572666c6f777365sting overflowse
0x5f150c6d61637175697265206e6f74206f6e20macquire not on
0x5f151c746865204720737461636b72756e7469the G stackrunti
0x5f152c6d653a2073706c697420737461636b20me: split stack
0x5f153c6f766572666c6f77737472696e672063overflowstring c
0x5f154c6f6e636174656e6174696f6e20746f6foncatenation too
0x5f155c206c6f6e67696e76616c69642066756e longinvalid fun
0x5f156c6374696f6e2073796d626f6c20746162ction symbol tab
0x5f157c6c6574726163653a2072656164696e67letrace: reading
0x5f158c2061667465722073687574646f776e72 after shutdownr
0x5f159c756e74696d653a207472616365626163untime: tracebac
0x5f15ac6b20737475636b2e2070633d74726965k stuck. pc=trie
0x5f15bc6420746f207472616365206465616420d to trace dead
0x5f15cc676f726f7574696e6572756e74696d65goroutineruntime
0x8979b500000039cf100103000000bacf100103...9............
0x8979c5000000bacf100103000000a9d6100105................
0x8979d5000000a9d610010500000090cf100103................
0x8979e50000008acf1001030000009ccf100103................
0x8979f50000009ccf100103000000abcf100103................
0x897a05000000abcf1001030000000000000000................
0x897a1500000000000000000000003077af0c92...........0w...
0x897a2574080241e1c107e6d618e67061746809t..A.......path.
0x897a3573616c61740a6d6f640973616c617409salat.mod.salat.
0x897a4528646576656c29090a64657009676974(devel)..dep.git
0x897a556875622e636f6d2f537461636b457863hub.com/StackExc
0x897a6568616e67652f776d690976312e322e31hange/wmi.v1.2.1
0x897a750968313a56496b6176465058536a636e.h1:VIkavFPXSjcn
0x897a85532b4f38795471374e4933326b305235S+O8yTq7NI32k0R5
0x897a95416a2b7633397932395659444f53413dAj+v39y29VYDOSA=
0x897aa50a646570096769746875622e636f6d2f.dep.github.com/
0x897ab5616e64796772756e77616c642f766466andygrunwald/vdf
0x897ac50976312e312e300968313a676d737470.v1.1.0.h1:gmstp
0x897ad5305237444f6570495a76576f534a59390R7DOepIZvWoSJY9
0x897ae537697837514f72737870475055364b757ix7QOrsxpGPU6Ku
0x897af5734b587176773d0a6465700967697468sKXqvw=.dep.gith
0x897b0575622e636f6d2f62756765722f6a736fub.com/buger/jso
0x897b156e7061727365720976312e312e310968nparser.v1.1.1.h
0x897b25313a32506e4d6a665744377742494c6a1:2PnMjfWD7wBILj
0x897b357151627435333076353736412f634162qQbt530v576A/cAb
0x897b45517645573967474970594d55733d0a64QvEW9gGIpYMUs=.d
0x897b556570096769746875622e636f6d2f6361ep.github.com/ca
0x897b65706e7370616365686f6f6b2f7461736bpnspacehook/task
0x897b756d61737465720976302e302e302d3230master.v0.0.0-20
0x897b853231303531393233353335332d313632210519235353-162
0x897b953964663763383565390968313a356a6d9df7c85e9.h1:5jm
0x897ba5745741447435447a44384e6e50786371tWADt5DzD8NnPxcq
0x897bb56431467a62464e5a4e66624a474e6544d1FzbFNZNfbJGNeD
0x897bc5622b574b6a6f4a303d0a646570096769b+WKjoJ0=.dep.gi
0x897bd5746875622e636f6d2f676f2d6f6c652fthub.com/go-ole/
0x897be5676f2d6f6c650976312e322e36096831go-ole.v1.2.6.h1
0x897bf53a2f467066366f46506f6546696b3974:/Fpf6oFPoeFik9t
0x897c05793773696f623047364b653851765145y7siob0G6Ke8QvQE
0x897c157556637543687077587a70593d0a6465uVcuChpwXzpY=.de
0x897c2570096769746875622e636f6d2f676f72p.github.com/gor
0x897c35696c6c612f776562736f636b65740976illa/websocket.v
0x897c45312e352e330968313a736144745a36501.5.3.h1:saDtZ6P
0x897c5562782f30752b6267595133713936705abx/0u+bgYQ3q96pZ
0x897c6567437a66684b5847507174376b5a3732gCzfhKXGPqt7kZ72
0x897c75614e4e673d0a64657009676974687562aNNg=.dep.github
0x897c852e636f6d2f6c786e2f77696e0976302e.com/lxn/win.v0.
0x897c95302e302d3230323130323138313633390.0-202102181639
0x897ca531362d6133373731323165393539650916-a377121e959e.