Threats Tagged 'windows defender evasion'

Salat Stealer is a Go-based information stealer malware that performs extensive system reconnaissance and extracts sensitive data such as browser credentials, cryptocurrency wallets, and communication platform data from Discord and Steam. It includes advanced surveillance features like desktop streaming and audio/video capture via microphone and webcam. The malware is distributed notably by bundling with Xeno Executor, a gaming utility tool, enabling full system compromise. It uses sophisticated evasion techniques including disabling Windows Defender via PowerShell scripts, persistence through registry run keys, and token impersonation of lsass.exe for privilege escalation. Deployment is obfuscated using batch script and Rust-based loaders.