Behavioral task
behavioral1
Sample
change name.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
change name.exe
Resource
win10v2004-20230220-en
General
-
Target
change name.exe
-
Size
1.6MB
-
MD5
283fdb9eda4a4b43b398e51a01a27fb3
-
SHA1
8aa23754e9e436c91ef0f4405b11789311423556
-
SHA256
6c3104bc12e1af9c07862507fd8c6a22c56286150c3b771d8f30107ca874e4f6
-
SHA512
3487d32e9c44990a223c0f65f9b3037ca081a0fc65266a476f5f2055913a9c35fc00f396c7b2cb8d1683256d2b020dfae520e46059543dcb842d3cd662babe53
-
SSDEEP
24576:D5i2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgL6:ETq24GjdGSiqkqXfd+/9AqYanieKd
Malware Config
Extracted
stealerium
https://discord.com/api/webhooks/1086388045063925850/ezZpr2UyWD2lTqF8qnoPfkcw5wysE2yv62F31o-lA0M0aeVjYqQluIvpKWAxh3N5P_6O
Signatures
-
Stealerium family
Files
-
change name.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ