🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://github.com/gigaempressclip/cbnoqxdb/releases/download/Ai/service.exe.

Database Entry


IOC ID:1975008
IOC: https://github.com/gigaempressclip/cbnoqxdb/releases/download/Ai/service.exe
IOC Type :url
Threat Type :payload_delivery
Malware: SalatStealer
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS36459 GITHUB
Country:- US
First seen:2026-10-20 05:11:08 UTC
Last seen:never
UUID:083c035a-cc3c-11f1-bd13-42010aa4000a
Reporter wristhulk
Reward 5 credits from ThreatFox
Tags:Downloader Github go SalatStealer
Reference: https://bazaar.abuse.ch/sample/5c5548382cec74538a7b81454bfe0868c17d60dc0a74944e92e04b04a12eed0c/

Avatar
wristhulk
Stage-3 URL hardcoded (base64, Go ldflags main.url) in the Go downloader e7f172b1946b06674fb57333fdbe46af311a64bda7e104d88d35bf2312f69e14, dropped by zapret-discord.bat (3d9a8680..., SalatStealer) inside fake zapret GitHub lures (zip 5c5548382cec74538a7b81454bfe0868c17d60dc0a74944e92e04b04a12eed0c). GitHub account gigaempressclip already removed when found (2026-10-19). Static analysis only.