What is salat-stealer-telegram-proxy-decoy-c2-analysis?

This repository is a reverse engineering writeup of a piece of malware called Salat Stealer. It is not a tool you install or run. Instead it is documentation, aimed at security researchers, that walks through how this malware works and what evidence it leaves behind. The writeup explains that Salat Stealer is written in Go and disguises itself as a legitimate Telegram Proxy application. When someone runs it, they see a working looking proxy interface, which distracts them while the malicious code runs in the background. The analysis then digs into the malware's binary strings and finds plaintext addresses used for command and control communication, along with a unique Go build identifier that can help link this sample to other versions of the same malware. The document also covers how the malware manipulates Windows security tokens to grant itself full file access, which lets it read, write, and delete important files, escalate its privileges, and hide more effectively from security software. Two encrypted or obfuscated blocks of memory are examined as well, one of which contains a Turkish language error message, suggesting the malware's author may be Turkish or developed it in a Turkish speaking environment. The repository ends with a summary of key findings and practical detection recommendations, such as blocking the specific command and control domains found, watching for the fake Telegram Proxy behavior, and monitoring for the token manipulation technique described. It also links to where the original malware sample can be downloaded from a public malware sample database for researchers who want to do their own analysis. The tools used for this investigation include Ghidra, Binary Ninja, Process Hacker, and WinDbg, all standard tools in malware reverse engineering.