TF-2019809
high
📛 Threat Title
SalatStealer: Domain that is used for botnet Command&control (C&C) morkovka.cn
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: SalatStealer. Confidence: 75. First seen: 2026-11-08 00:26:06 UTC. Reporter: whereyoufell. Tags: SalatStealer, stealer, webrat.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
morkovka.cn
UrlVoid 0 / 36
IOC database
- Type
- domain
- Value
morkovka.cn- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain that is used for botnet Command&control (C&C) attributed to SalatStealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
- External reference ThreatFox IOCs
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: SalatStealer. Confidence: 75. First seen: 2026-11-08 00:26:06 UTC. Reporter: whereyoufell. Tags: SalatStealer, stealer, webrat.
Remediations (10)
-
web:cyberint.com
Introduction to SalatStealer Malware SalatStealer is a Go-based infostealer family first observed in August 2026, built for x86 Windows environments and focused on credential theft. Its documented capabilities include stealing authentication credentials, hiding executing code, and degrading security software. In the observed context, it appeared as a separate Windows stealer staged alongside a ...
-
web:cybersecuritynews.com
Salat Stealer targets Windows, stealing browser logins and crypto wallets via fake cracks, cheats, and stealthy Go-based evasion.
-
web:ismalicious.com
3,871 indicators of compromise attributed to the SalatStealer malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.
-
web:research.splunk.com
The stolen information is compressed and transmitted to remote command-and-control servers, where operators can monetize it through credential sales, account takeover, or use it to facilitate deeper intrusion into corporate networks.
-
web:socprime.com
Summary Salat Stealer is a Go-based remote access trojan that functions as a full-featured post-exploitation framework. It supports multiple communication channels, including WebSocket, HTTP/2, HTTP/3, and QUIC, giving operators flexible and resilient command-and-control options. The malware also includes broad credential theft capabilities, targeting browser data, cryptocurrency wallets ...
-
web:wazuh.com
Rule ID 100605 is triggered when Salat stealer establishes an outbound connection to a known external IP, consistent with command-and-control communication or remote access activity. Rule ID 100606 is triggered when Salat stealer performs DNS queries to public resolvers for connectivity checks, environment validation, or C2 resolution.
-
web:www.cyfirma.com
Further analysis reveals that , after a brief delay of 5000ms, the script retrieves a file named sniff_domain_list.txt. This file contains a list of command-and-control (C2) panel domains , including entries such as webrat.top and webr.at. The script then iterates through each domain and sends a request to the /alive.php endpoint.
-
web:www.microsoft.com
Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.
-
web:www.sonicwall.com
Overview This week, SonicWall Capture Labs Threat Research Team analyzed a sample of SalatStealer . This is a Golang malware capable of infiltrating a system and enumerating through browsers, files, cryptowallets and systems while embedding a complete array of monitoring tools to push and pull any data on disk. Infection Cycle Initial detection of the sample shows that it is UPX packed ...
-
web:www.splunk.com
Learn how the Salat Stealer campaign uses Go-based surveillance and data exfiltration, and explore its infection chain and how to hunt for this threat using Splunk.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.