UPX-packed stealer PE with zeroed timestamp (SalatStealer/XenoRAT)

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•4

Detects 32-bit Windows PE files packed with UPX that exhibit a zeroed compile timestamp, a characteristic often associated with staged SalatStealer or XenoRAT binaries observed in Operation CameraSwarm.