Loading malware…
WebRAT, also referred to as Salat Stealer, is a backdoor/remote access trojan with information-stealing and spyware capabilities that was first reported in early 2025. It allows attackers to control infected Windows systems and steal data from cryptocurrency wallets and from Telegram, Discord, and Steam accounts. Reported surveillance functions include keylogging, screen recording or screenshot capture, and webcam and microphone monitoring. Multiple reports describe it as a backdoor with credential theft and device surveillance functionality, and some reporting also characterizes it as an infostealer.
Observed distribution initially included pirated software, cracked applications, and game cheats for titles such as Roblox, Counter-Strike, Rust, and gaming utilities. By at least September 2025, operators expanded distribution to fake GitHub repositories masquerading as proof-of-concept exploit code for recently disclosed or high-profile CVEs, specifically targeting students, junior testers, infosec enthusiasts, and less-experienced security researchers. The repositories used detailed, often machine-generated descriptions to appear legitimate and typically delivered password-protected ZIP archives. These archives contained a decoy DLL, a batch file, and a loader executable such as rasmanesc.exe.
The documented loader behavior includes privilege escalation, disabling Microsoft Defender, and downloading the main WebRAT payload from hardcoded infrastructure. Reported infrastructure and IOCs include the domains ezc5510min.temp.swtest.ru and shopsleta.ru, and MD5 hashes including 61b1fc6ab327e6d3ff5fd3e82b430315, 28a741e9fcd57bd607255d3a4690c82f, and a13c3d863e8e2bd7596bac5d41581f6a. Kaspersky reported identifying 15 malicious GitHub repositories used in one such campaign. The campaign’s novelty was the social-engineering lure rather than major functional changes in the malware.
WebRAT is also notable as a reference point for later malware families. Kaspersky reported that CrystalRAT/CrystalX RAT shares strong similarities with WebRAT/Salat Stealer, including similar panel design, Go-based code, and a similar bot-based sales system. Separate reporting also noted WebRAT appearing as a payload delivered by Olymp Loader in 2025.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
On execution: mutex check ( checkDupe ), UAC bypass ( Elevate ), persistence via registry Run key and Task Scheduler...
main.DuplicateUserTokenFromSessionID -- WTS token duplication main.getSystemToken -- SYSTEM token acquisition
main.DuplicateUserTokenFromSessionID -- WTS token duplication main.getSystemToken -- SYSTEM token acquisition
The PE sections are labeled UPX0 , UPX1 , UPX2 . But run upx -d and you get NotPackedException: not packed by UPX . The section names are fake -- a social engineering artifact targeting analysts...
“malicious HWP file disguised as a… document” and “abusing the icon of SentinelOne… spoofing it… Rust based implant… acting as a legitimate binary” and “Webrat… disguising itself as cheats… or as cracked software.”
main.NtQuerySystemHandles -- Handle enumeration (LSASS targeting) main.findLsassProcess -- LSASS process location
main.runKeylogger -- Start capture main.keyPressCallback -- SetWindowsHookEx WH_KEYBOARD callback main.windowChangeCallback -- Active window change (context labeling)
Collection hits 34 browsers, 28 crypto wallets, Telegram/Discord/Steam tokens, keylogger with window context, screenshots, and clipboard.
Chromium-based browsers get the full treatment: DPAPI master key decryption, AES-GCM cookie/password decryption...
main.runKeylogger -- Start capture main.keyPressCallback -- SetWindowsHookEx WH_KEYBOARD callback main.windowChangeCallback -- Active window change (context labeling)
The actual C2 connection uses WebSocket over TLS for command-and-control, and QUIC (HTTP/3) for bulk data exfiltration.
Every infected host becomes a SOCKS5 proxy node: main.(*socks5Conn).Serve -- SOCKS5 server ... main.p2pSocks -- P2P SOCKS relay
The actual C2 connection uses WebSocket over TLS for command-and-control, and QUIC (HTTP/3) for bulk data exfiltration.
SalatStealer is not just a stealer -- it is a full RAT ... screen streaming, shell, SOCKS proxy
SalatStealer has been documented before ... The binary imports github.com/xssnick/tonutils-go v1.16.0 and implements two functions: main.tonResolve and main.tryTonResolve.
A tloop function implements a polling loop that periodically re-resolves via TON, meaning the operator can rotate infrastructure mid-campaign and all infected hosts will follow within one polling interval. This is Fast Flux DNS with the blockchain as the authoritative server.
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A trojan/RAT delivered through fake CVE proof-of-concept repositories in a separate late-2025 campaign targeting researchers-in-training such as students and junior testers.
Referenced as malware similar to CrystalRAT; also known as Salat Stealer.
A previously known malware/tool written in Go whose panel layout and sales infrastructure closely resembled early Webcrystal RAT, suggesting CrystalX evolved from or was heavily inspired by it.
Previously known malware whose panel and sales workflow closely resembled CrystalX RAT/Webcrystal RAT; referenced as a likely template or predecessor and also known as Salat Stealer.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.