stealthworker | 24971a3522600c9f516fd6352c06e8a948a206b8ba18027a10452d7815e60928

General

Target

24971a3522600c9f516fd6352c06e8a948a206b8ba18027a10452d7815e60928
Size

7.6MB
MD5

5e26bb348964b5fff18c87595015be47
SHA1

7bf110694ab59da86fc8730af29caf97edf85921
SHA256

24971a3522600c9f516fd6352c06e8a948a206b8ba18027a10452d7815e60928
SHA512

5c3a78323204b14389cc6cf390bac5d0e2ff94cb1e9d1131c903929dd2c05d425c151c634cfd7ded9d4db69ded74e9def0b30c1ca55effdb70cea6e4afcbb8fc
SSDEEP

98304:nD0iAJJKQheKCfQvgOzVPX4xLp2nXSoxkeDT5EVlhMoJIXjU4OM:D0jkN4xk8Tm7JX4

Score

10^/10

botnet stealthworker

Malware Config

Signatures

StealthWorker Payload 1 IoCs
botnet

Processes:

resource yara_rule

sample stealthworker
Stealthworker family
stealthworker

resource	yara_rule
sample	stealthworker

Files

24971a3522600c9f516fd6352c06e8a948a206b8ba18027a10452d7815e60928
.exe windows x86

1c2a6fbef41572f4c9ce8acb5a63cde7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

winmm

timeEndPeriod
timeBeginPeriod

ws2_32

WSAGetOverlappedResult

kernel32

WriteFile
WriteConsoleW
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
LoadLibraryA
LoadLibraryW
GetSystemInfo
GetStdHandle
GetQueuedCompletionStatus
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 198KB - Virtual size: 285KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 902B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.xObf
Size: 877KB - Virtual size: 877KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1c2a6fbef41572f4c9ce8acb5a63cde7

Headers

File Characteristics

Imports

winmm

ws2_32

kernel32

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 3.4MB - Virtual size: 3.4MB

.data Size: 198KB - Virtual size: 285KB

.idata Size: 1024B - Virtual size: 902B

.symtab Size: 512B - Virtual size: 4B

.xObf Size: 877KB - Virtual size: 877KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 3.4MB - Virtual size: 3.4MB

.data
Size: 198KB - Virtual size: 285KB

.idata
Size: 1024B - Virtual size: 902B

.symtab
Size: 512B - Virtual size: 4B

.xObf
Size: 877KB - Virtual size: 877KB