TF-2019806
high
📛 Threat Title
SalatStealer: Domain that is used for botnet Command&control (C&C) fsbrf.org
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: SalatStealer. Confidence: 100. First seen: 2026-11-08 00:25:10 UTC. Reporter: whereyoufell. Tags: SalatStealer, stealer, webrat.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
fsbrf.org
UrlVoid 2 / 36
IOC database
- Type
- domain
- Value
fsbrf.org- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain that is used for botnet Command&control (C&C) attributed to SalatStealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
- External reference ThreatFox IOCs
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: SalatStealer. Confidence: 100. First seen: 2026-11-08 00:25:10 UTC. Reporter: whereyoufell. Tags: SalatStealer, stealer, webrat.
Remediations (10)
-
web:blog.netmanageit.com
To evade endpoint defenses, Salat Stealer employs process masquerading by renaming its threads to mimic trusted Windows processes. It leverages registry run keys and scheduled tasks to achieve persistence, ensuring execution upon system reboot or user logon. The binary rotates through multiple fallback domains for command and control connectivity, thwarting simple domain -blocking measures ...
-
web:cyberint.com
Introduction to SalatStealer Malware SalatStealer is a Go-based infostealer family first observed in August 2026, built for x86 Windows environments and focused on credential theft. Its documented capabilities include stealing authentication credentials, hiding executing code, and degrading security software. In the observed context, it appeared as a separate Windows stealer staged alongside a ...
-
web:cybersecuritynews.com
Salat Stealer targets Windows, stealing browser logins and crypto wallets via fake cracks, cheats, and stealthy Go-based evasion.
-
web:huntback.io
Huntback captured a live WEB_RAT bootstrap, while DNS, TLS certificates, malware configurations, and a TON-based dead drop connect the current panel to SalatStealer's resilient command-and-control infrastructure.
-
web:ismalicious.com
3,871 indicators of compromise attributed to the SalatStealer malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.
-
web:research.splunk.com
The stolen information is compressed and transmitted to remote command-and-control servers, where operators can monetize it through credential sales, account takeover, or use it to facilitate deeper intrusion into corporate networks.
-
web:socprime.com
Summary Salat Stealer is a Go-based remote access trojan that functions as a full-featured post-exploitation framework. It supports multiple communication channels, including WebSocket, HTTP/2, HTTP/3, and QUIC, giving operators flexible and resilient command-and-control options. The malware also includes broad credential theft capabilities, targeting browser data, cryptocurrency wallets ...
-
web:www.cyfirma.com
Further analysis reveals that , after a brief delay of 5000ms, the script retrieves a file named sniff_domain_list.txt. This file contains a list of command-and-control (C2) panel domains , including entries such as webrat.top and webr.at. The script then iterates through each domain and sends a request to the /alive.php endpoint.
-
web:www.microsoft.com
Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.
-
web:www.splunk.com
Learn how the Salat Stealer campaign uses Go-based surveillance and data exfiltration, and explore its infection chain and how to hunt for this threat using Splunk.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.