TF-2019846
high
📛 Threat Title
SalatStealer: Domain that is used for botnet Command&control (C&C) cazar.cc
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: SalatStealer. Confidence: 75. First seen: 2026-11-08 00:27:06 UTC. Reporter: whereyoufell. Tags: SalatStealer, stealer, webrat.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
cazar.cc
IOC database
- Type
- domain
- Value
cazar.cc- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain that is used for botnet Command&control (C&C) attributed to SalatStealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
- External reference ThreatFox IOCs
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: SalatStealer. Confidence: 75. First seen: 2026-11-08 00:27:06 UTC. Reporter: whereyoufell. Tags: SalatStealer, stealer, webrat.
Remediations (10)
-
web:blog.netmanageit.com
Our analysis dissects its components, highlights evasion strategies, and maps the resilient command and control infrastructure that underpins its operations. 2. Technical Architecture and Payload Delivery Developed as a web_rat variant, Salat Stealer begins its infection chain through social engineering or drive-by download tactics.
-
web:cyberint.com
Introduction to SalatStealer Malware SalatStealer is a Go-based infostealer family first observed in August 2026, built for x86 Windows environments and focused on credential theft. Its documented capabilities include stealing authentication credentials, hiding executing code, and degrading security software. In the observed context, it appeared as a separate Windows stealer staged alongside a ...
-
web:cybersecuritynews.com
Salat Stealer targets Windows, stealing browser logins and crypto wallets via fake cracks, cheats, and stealthy Go-based evasion.
-
web:ismalicious.com
3,871 indicators of compromise attributed to the SalatStealer malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.
-
web:nhimg.org
TL;DR: Salat stealer is a Go-based information stealer that targets Windows endpoints for browser credentials, Telegram sessions, and wallet data, while using packing, masquerading, and C2 infrastructure to evade analysis, according to Wazuh. The article shows that endpoint telemetry, file monitoring, and active response remain essential when credential theft is paired with stealthy persistence.
-
web:socprime.com
Summary Salat Stealer is a Go-based remote access trojan that functions as a full-featured post-exploitation framework. It supports multiple communication channels, including WebSocket, HTTP/2, HTTP/3, and QUIC, giving operators flexible and resilient command-and-control options. The malware also includes broad credential theft capabilities, targeting browser data, cryptocurrency wallets ...
-
web:wazuh.com
Its combination of stealth, persistence, and remote control capabilities makes it dangerous for organizations handling sensitive data. In this blog post, we demonstrate how to configure Wazuh to detect and mitigate Salat stealer infections on Windows endpoints.
-
web:www.cyfirma.com
Further analysis reveals that , after a brief delay of 5000ms, the script retrieves a file named sniff_domain_list.txt. This file contains a list of command-and-control (C2) panel domains , including entries such as webrat.top and webr.at. The script then iterates through each domain and sends a request to the /alive.php endpoint.
-
web:www.microsoft.com
Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.
-
web:www.splunk.com
Learn how the Salat Stealer campaign uses Go-based surveillance and data exfiltration, and explore its infection chain and how to hunt for this threat using Splunk.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.