Executive Summary
CYFIRMA has identified Salat Stealer (also known as WEB_RAT), a Go-based infostealer operated under a Malware-as-a-Service (MaaS) model by Russian-speaking actors NyashTeam and Kapchenka. The malware targets Windows systems to exfiltrate browser credentials, session data, and cryptocurrency assets from desktop wallets and browser extensions. It utilizes a resilient C2 infrastructure with multiple fallback domains and a centralized web-based control panel.
Technically, Salat Stealer employs UPX packing to evade static analysis and establishes persistence through multiple registry Run keys and scheduled tasks disguised as legitimate processes like Lightshot.exe or RuntimeBroker.exe. It further impairs defenses by silently adding directory exclusions to Windows Defender and disabling the Windows Recovery Environment (WinRE) to prevent system resets.
This threat is significant due to its low-cost subscription model (starting at 1,199 rubles), which lowers the barrier for entry-level cybercriminals. The malware's focus on session hijacking (Telegram/Steam) and cryptocurrency theft presents a direct financial risk to both individuals and organizations, particularly those utilizing browser-based wallets or unhardened Windows environments.