WEB_RAT Is Still Alive: Huntback Maps SalatStealer's Active Panel, Rotating C2, and TON Fallback

Huntback captured an active SalatStealer bootstrap on its apparent backend, while live TLS certificates connect the current WEB_RAT panels to the stealer's rotating C2 infrastructure. Newer builds add TON-based C2 recovery, allowing operators to replace seized or blocked servers without issuing another malware build.

On 16 October 2026, Huntback recovered what initially appeared to be an exposed config.json from 176.12.71[.]122. Its contents were not JSON. The response was a small JavaScript bootstrap that registered a service worker and redirected visitors into a WEB_RAT login flow.

The same server returned essentially the same page for .env. That changed the interpretation immediately. Huntback had not discovered two exposed configuration files; it had found a catch-all route on infrastructure associated with the operator-facing side of WEB_RAT.

WEB_RAT is not simply the name of a generic remote-administration panel. It is also the branding used by SalatStealer, a Go-based Windows information stealer offered through a malware-as-a-service model. SalatStealer steals browser credentials and sessions, targets cryptocurrency wallets and messaging applications, weakens endpoint protections, establishes persistence, and gives subscribers a web panel through which they can manage infected systems.^[1][2]

Huntback's observation provided a fresh point from which to map the contemporary infrastructure. Passive DNS showed that the captured IP was tied to wruser[.]org. Live TLS certificates then connected that domain to salator[.]es, sa1atik[.]cn, and websalat[.]top. A separate certificate grouped four WEB_RAT panel domains on an OVH address. Public malware-analysis records independently recovered the same domains from SalatStealer configurations, including the distinctive /sa1at/ C2 path.^[3][4][5]

The most important development is the recovery mechanism used when those conventional domains fail. Recent SalatStealer builds query TON DNS through a public API, decode a replacement IP address stored in a blockchain record, and construct a new /sa1at/ endpoint. This technique turns the blockchain into a dead drop: taking down one domain or IP does not remove the instructions that tell infected systems where to reconnect.^[6][7]

This report documents the Huntback capture, reconstructs the infrastructure relationships, distinguishes panel traffic from probable data C2, and provides a defensible set of indicators and detection opportunities. No attempt was made to authenticate to the WEB_RAT panel, access victim records, submit data to the C2, or detonate malware against the live infrastructure.

Executive summary

• Huntback captured an active WEB_RAT bootstrap. The latest copy was retrieved from 176.12.71[.]122 at 23:43 UTC on 16 October 2026. The page registered /sw.js and redirected visitors to a WEB_RAT login flow.
• The apparent file exposures were catch-all responses. Requests for both config.json and .env returned a nearly identical 990-byte page. The filenames therefore did not expose real JSON or environment secrets; the security value lies in the redirect logic and infrastructure link.
• Huntback has observed the page repeatedly. The config.json response had been seen 24 times and the .env response 117 times when reviewed. These counts indicate a persistent response pattern rather than a one-off capture.
• The captured backend is tied to wruser[.]org. On 17 October, the domain resolved directly to 176.12.71[.]122. The host presented a certificate covering wruser[.]org, *.wruser[.]org, and salator[.]es.
• TLS certificates bridge the current C2 cluster. The live salator[.]es certificate also covered sa1atik[.]cn and websalat[.]top. Those same domains have been extracted from recent SalatStealer configurations and classified as high-confidence C2 infrastructure by ThreatFox.^[3][4]
• A separate host carries the panel-facing WEB_RAT domains. webr[.]at, webrat[.]org, webrat[.]es, and webrat[.]uk all resolved to 141.95.112[.]163 and appeared together in one certificate. The Huntback page explicitly redirected webr[.]at to webrat[.]org/login/.
• The infrastructure supports multiple fallback layers. Conventional HTTPS domains, a secondary port 992, multiple panel domains, service-worker bootstrapping, and TON-based IP recovery all reduce the impact of a single takedown.
• The TON fallback is operationally important but not previously unknown. Recent public research and ThreatFox records already document the technique. Huntback's contribution is current infrastructure confirmation, a live backend capture, and certificate-based mapping of the panel and C2 tiers.^[6][7]
• Attribution should remain conservative. The evidence establishes a SalatStealer/WEB_RAT infrastructure cluster with high confidence. It does not establish that every subscriber, payload, or victim is controlled by one operator, nor does it support attribution to a named state actor.

Key judgments

The Huntback capture

Huntback recovered two named objects from 176.12.71[.]122:80:

Both responses contain the same core behavior:

1. Check whether the browser supports service workers.
2. Register /sw.js.
3. If the current hostname is webr[.]at, redirect to hxxps://webrat[.]org/login/.
4. Otherwise, redirect to the server's local /login/ route.
5. Load Cloudflare Browser Insights.

The two content hashes differ because the embedded Cloudflare beacon resource changed between captures. The functional redirect code did not materially change.

Why the initial labels were misleading

Huntback labelled the objects c2 and exposed-secret, and associated them with ATT&CK T1071. The C2 label is directionally useful. The exposed-secret label is not: neither response contained environment variables or a JSON configuration.

This is an important analytic distinction. Automated collection systems frequently name recovered content according to the requested path. A response labelled .env may be a real environment file, a denial page, an application shell, or, as in this case, a catch-all redirect. Content must outrank filename during triage.

The false-positive filename does not diminish the find. In this instance, the catch-all behavior exposed something more operationally useful: a stable relationship between an IP, a login workflow, two branded WEB_RAT domains, and a service-worker bootstrap.

Infrastructure reconstruction

The investigation identified two main infrastructure tiers.

Tier 1: operator-facing WEB_RAT panels

On 17 October 2026, four related domains resolved to the same OVH address:

The host presented a Let's Encrypt certificate with:

Subject: CN=webr.at
Not before: 2026-09-14 14:44:04 UTC
Not after:  2026-12-13 14:44:03 UTC
SANs:
  webr.at
  webrat.es
  webrat.org
  webrat.uk

The explicit SAN grouping is stronger than a simple shared-IP observation. It shows that the certificate requester intentionally placed the four names into the same deployment.

ThreatFox separately reported webrat[.]es as a high-confidence SalatStealer indicator and described a CAPTCHA-protected login panel at /login/ on the same OVH address.^[8]

Tier 2: C2 and exfiltration infrastructure

The Huntback IP sits in the second tier:

The certificate served by wruser[.]org contained:

Subject: CN=wruser.org
Not before: 2026-09-17 17:30:25 UTC
Not after:  2026-12-16 17:30:24 UTC
SANs:
  *.wruser.org
  salator.es
  wruser.org

The certificate served by salator[.]es contained:

Subject: CN=salator.es
Not before: 2026-09-14 16:12:12 UTC
Not after:  2026-12-13 16:12:11 UTC
SANs:
  sa1atik.cn
  salator.es
  websalat.top

The IP behind salator[.]es had changed by the time of this investigation, yet the certificate relationships preserved the link to the other domains. That is exactly why certificate pivots remain useful when operators rotate DNS.

Combined view

This role separation is an analytic assessment rather than an architectural diagram recovered from the operators. It is supported by the different domain groups, paths, and sample configurations, but the underlying servers may host additional functions.

Independent malware correlation

The infrastructure map is not based solely on naming conventions.

ThreatFox classified wruser[.]org, salator[.]es, and websalat[.]top as SalatStealer botnet C2 with 100% confidence. The records cite two recent sample hashes and specify /sa1at/ on ports 443 and 992.^[3][4]

32db4595652db96810710a1c79ecb11d83acd4a4d8ae661e8a430b64a661e14c
9a26460e4f8605210d681aebf623588644e9db425ae5d8500c24f2af8aadb506

An ANY.RUN-derived observation reported processes from a SolaraV3.zip analysis making repeated TLS connections to 176.12.71[.]122:443. The activity was classified as SalatStealer, providing behavioral support for the IP-level association.^[9]

Joe Sandbox recovered multiple SalatStealer configurations containing:

hxxps://salator[.]es/sa1at/
hxxps://wrat[.]in/sa1at/
hxxps://salator[.]ru/sa1at/
hxxps://websalat[.]top/sa1at/
hxxps://salat[.]cn/sa1at/

The exact domain set changes between generations, but the /sa1at/ path remains consistent.^[5][10]

This convergence (Huntback content, live DNS, certificate SANs, ThreatFox entries, sandbox traffic, and embedded malware configuration) supports a high-confidence assessment. Any one of those sources could be misleading in isolation; together they form a coherent cluster.

What SalatStealer steals

SalatStealer is also tracked as WEB_RAT. Public analysis describes a Go-based Windows stealer with a broad theft and remote-management feature set.^[1][2]

Credential and session theft

The malware targets browser databases and session material, including:

• saved usernames and passwords;
• cookies and authenticated browser sessions;
• autofill and form data;
• Telegram tdata sessions;
• Steam configuration and session information;
• browser-extension storage.

The theft of session tokens is particularly important. A valid session may allow an attacker to access an account without replaying a password and can sometimes bypass the protection expected from multifactor authentication.

Cryptocurrency targeting

Documented versions enumerate installed cryptocurrency applications, wallet databases, browser extensions, private-key material, and configuration files. Public analyses identify targets including MetaMask, Trust Wallet, Coinbase Wallet, Phantom, Exodus, Electrum, Atomic Wallet, Guarda, and numerous other desktop and extension-based wallets.^[1][5]

Persistence and defense evasion

Observed persistence mechanisms include Run-key entries and scheduled tasks disguised with familiar names such as:

Lightshot
Procmon
RuntimeBroker

The malware has also been documented adding broad Microsoft Defender exclusions, disabling recovery functionality, checking for virtualized environments, and masquerading in plausible program directories.^[1][2]

Remote-control features

The WEB_RAT panel reportedly supports WebSockets, remote PowerShell execution, scripted defense impairment, additional file delivery, real-time interaction, and sharing access to infected systems between subscribers.^[1]

The result is broader than a single-pass password stealer. The ecosystem combines credential theft, persistent access, post-compromise tooling, and a commercial control plane.

Resilience before TON

SalatStealer already employed several forms of infrastructure resilience before its blockchain fallback appeared.

Hard-coded backup C2s

Samples carry multiple HTTPS endpoints. If one domain fails, the malware can try another without receiving an updated configuration from the failed server.

Panel-domain failover

CYFIRMA documented scripts that checked multiple WEB_RAT domains for an alive.php response and redirected authenticated users to whichever panel remained available. It also documented cross-domain cookie-transfer behavior intended to preserve panel access during failover.^[1]

Multiple network ports

Recent reporting identifies the same /sa1at/ route on standard HTTPS and TCP port 992. Blocking only the default port can therefore leave an alternate path available.^[3]

Service workers

The Huntback bootstrap attempts to register /sw.js before redirecting. Service workers can provide legitimate offline and update behavior, but in this context they also give the panel an additional browser-side control point for routing, caching, and application updates. Huntback did not retrieve or analyze the worker body, so its exact purpose remains unconfirmed.

TON as a blockchain dead drop

Recent builds add another layer: TON DNS.

Public static analysis recovered strings directing the malware to queries such as:

hxxps://tonapi[.]io/v2/dns/webratpanel[.]ton/resolve
hxxps://tonapi[.]io/v2/dns/remoteadministratortool[.]ton/resolve

The malware reads the returned record, decodes text representing an IP address, and constructs a new URL:

hxxps://<decoded-address>/sa1at/

ThreatFox reported that, at 14:02 UTC on 13 October 2026, the record for webratpanel[.]ton contained the text 168.222.202.171. The associated indicator was therefore:

168[.]222[.]202[.]171:443

The sample used to recover this behavior was:

531540654836a5e5add5fe08432bc17c3582c1b0692b411278b1c96a3e5fe8db

Related TON names documented in public analysis include:

webratpanel[.]ton
remoteadministratortool[.]ton
shyetootval[.]ton
webratxaye1[.]ton

Why this matters

The blockchain is not carrying stolen browser databases or executable payloads in the observations reviewed here. Its function is narrower and more efficient: it publishes a small piece of routing information.

That creates a resilient recovery chain:

The operator can change the record without distributing a new malware build. Defenders can seize or block an individual server, but infected hosts still retain the logic required to discover its successor.

This is not equivalent to an unstoppable C2. Defenders can monitor the TON API path, block known TON names, inspect the follow-on destination, sinkhole conventional infrastructure, and remove the endpoint malware. It does, however, make domain-by-domain blocking an incomplete response.

Timeline

Collection time establishes when content was retrievable, not when it was first deployed. DNS and certificate observations also represent a point in time and may change after publication.

Detection and hunting guidance

Network indicators

Organizations should search DNS, proxy, firewall, TLS, and endpoint network telemetry for the following domains:

wruser.org
salator.es
sa1atik.cn
websalat.top
webr.at
webrat.org
webrat.es
webrat.uk
wrat.in
salator.ru
salat.cn

Historical WEB_RAT domains documented in earlier research include:

webrat.in
webrat.ru
webrat.su
webrat.top
posholnahuy.ru
pidorasina.ru

The older domains should be treated as historical hunting pivots rather than assumed-current blocking indicators.

IP indicators

Because the cluster rotates infrastructure, domains, certificate relationships, paths, and process behavior will generally be more durable than individual addresses.

High-value URL patterns

/sa1at/
/login/
/alive.php
/api/websocket/servers
/transferCookie.php
/v2/dns/webratpanel.ton/resolve
/v2/dns/remoteadministratortool.ton/resolve

The presence of /login/ alone is not distinctive. /sa1at/, the TON DNS names, and the combination of panel-domain requests are much stronger signals.

Ports

TCP/443
TCP/992

Port 443 is ubiquitous and should only be actioned with destination and path context. Port 992 combined with wruser[.]org or /sa1at/ is substantially more specific.

Endpoint behaviors

Search for:

• executables masquerading as Lightshot.exe, Procmon.exe, or RuntimeBroker.exe outside expected vendor paths;
• Run keys or scheduled tasks using those names;
• scheduled tasks configured to repeat at unusually short intervals;
• broad Defender exclusions created through Add-MpPreference;
• registry modification disabling Windows recovery or UAC-related controls;
• access to multiple browser SQLite databases followed by archive creation;
• access to Telegram tdata, Steam configuration, or cryptocurrency wallet locations by an unsigned process;
• WMI video-controller queries followed by stealer-like collection behavior;
• requests to TON API immediately followed by direct HTTPS communication with a newly observed IP;
• outbound connections to the same destination on both ports 443 and 992;
• creation of randomly named files in temporary directories immediately before network exfiltration.

ATT&CK mapping

Indicators of compromise

Current and recently observed domains

wruser[.]org
salator[.]es
sa1atik[.]cn
websalat[.]top
webr[.]at
webrat[.]org
webrat[.]es
webrat[.]uk

TON names

webratpanel[.]ton
remoteadministratortool[.]ton
shyetootval[.]ton
webratxaye1[.]ton

Infrastructure

176[.]12[.]71[.]122
141[.]95[.]112[.]163
194[.]226[.]98[.]121
168[.]222[.]202[.]171

Sample hashes

32db4595652db96810710a1c79ecb11d83acd4a4d8ae661e8a430b64a661e14c
9a26460e4f8605210d681aebf623588644e9db425ae5d8500c24f2af8aadb506
531540654836a5e5add5fe08432bc17c3582c1b0692b411278b1c96a3e5fe8db

Huntback bootstrap hashes

These hashes identify captured web responses rather than executable malware:

bb0863e9a1d61db862d40abaa13ff9cd2261d81ce06d81fd57e57ccaeabfe386
a417f43b1d7f1fdfbb2c5c8babb086155989dcd687518941e7faed46f4fa59b9

What Huntback adds

Earlier research already established that SalatStealer uses the WEB_RAT brand, operates as a commercial stealer, maintains multiple fallback domains, and has incorporated TON-based recovery.^[1][6][7]

Huntback adds a current observational layer:

1. A live WEB_RAT bootstrap was still being served from the apparent wruser[.]org backend on 16 October.
2. The bootstrap explicitly linked the short webr[.]at domain to webrat[.]org/login/.
3. Repeated catch-all responses showed that the route remained stable over multiple days and request paths.
4. Live certificates connected the captured backend to the current salator[.]es, sa1atik[.]cn, and websalat[.]top C2 cluster.
5. A separate live certificate grouped four operator-facing WEB_RAT panel domains on the same host.

This is best described as current infrastructure confirmation and expansion, not the first discovery of SalatStealer or its blockchain technique.

Limitations and analytic cautions

• Huntback recovered response content and metadata, not a server filesystem or panel database.
• The config.json and .env names were requested paths, not evidence that those files existed.
• Times-seen values describe Huntback observations and do not measure infections or victims.
• A domain on a certificate establishes administrative or deployment linkage, but does not by itself prove that every named domain performed the same role.
• DNS and hosting assignments can change quickly. IP indicators should be revalidated before takedown or blocking decisions.
• Public sandbox classifications can contain false positives. The assessment relies on convergence across multiple independent evidence types.
• SalatStealer is offered as a service. Infrastructure ownership, malware development, distribution, and individual subscriber activity may involve different people.
• No victim count, geography, or sector targeting can be established from the Huntback capture.
• No login attempt, credential use, victim access, or interaction with the /sa1at/ endpoint was performed.

Conclusion

The 990-byte page recovered by Huntback looked insignificant at first. It was neither a payload nor an exposed database, and its filenames proved misleading. Its value emerged through the pivots around it.

The redirect connected 176.12.71[.]122 to the WEB_RAT login infrastructure. DNS connected the address to wruser[.]org. Live certificates linked that domain to a set of SalatStealer C2 names. Independent malware configurations supplied the /sa1at/ route and backup-domain history. Finally, newer samples showed how the operators can recover from conventional infrastructure disruption by reading a replacement address from TON DNS.

The resulting design is layered rather than exotic: multiple panel domains, multiple C2 domains, alternate ports, service-worker bootstrapping, and a blockchain dead drop. None of those mechanisms makes the infrastructure invulnerable. Together, however, they make reactive single-indicator blocking far less effective.

For defenders, the practical lesson is to hunt the recovery chain, not just the current server. The most durable opportunities are the /sa1at/ path, TON API lookups for the known names, abnormal scheduled-task and Defender-exclusion behavior, and the transition from a blockchain resolution request to direct HTTPS communication with a fresh IP.

For researchers, the Huntback observation shows why apparently low-value web artifacts deserve careful content analysis. A false-positive .env can still expose the redirect that binds a live malware service together.

References

1. CYFIRMA: Unmasked: Salat Stealer
2. ANY.RUN: SalatStealer malware profile
3. ThreatFox: wruser.org
4. ThreatFox: salator.es
5. Joe Sandbox: Salat Stealer configuration
6. ThreatFox: SalatStealer TON fallback C2
7. RT-Solar: Blockchain dead drops, including WEB_RAT/SalatStealer
8. ThreatFox: webrat.es
9. AbuseIPDB: sandbox-derived report for 176.12.71.122
10. Joe Sandbox: additional Salat Stealer configuration
11. CTX Threat News: Salat Stealer infrastructure correlation