WorldWind Stealer.zip
- SHA256 072b84134ac680e4d9c0de2b8af4bc92b594d5266bdfc97f7211de31ae15e6d0
Behavioral task
behavioral1
Sample
WorldWind Stealer/Builder WorldWind Pro.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
0 signatures
30 seconds
Behavioral task
behavioral2
Sample
WorldWind Stealer/stub.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
5 signatures
30 seconds
General
- Target WorldWind Stealer.zip
- Size 1.1MB
- Sample230424-ynghhsga2t
- SHA256 072b84134ac680e4d9c0de2b8af4bc92b594d5266bdfc97f7211de31ae15e6d0
- MD5 f097e686fe25e51bff7d512b13e491f4
- SHA1 1ea0c427a22d36a65a657cb247ba38f448e02a38
- SHA512 8df04826e45fe847f3c3d8d30477675ad3647cd27bcfc2e20a03f48e3c38aa5ded31b93f38bc07a99e3adca49f39245c39d4deac7cdc591229500758edb08dbc
- SSDEEP 24576:DMrbWx60VnkbL5q+tDbzbcv/RglPaMhPjkhLZ4tFlK:Nxlyblq+tvvghLZAK
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Botnet
-
Default
C2
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/WorldWind Stealer/stub.dll asyncrat - Asyncrat family
- StormKitty payload 1 IoCs
resource yara_rule static1/unpack001/WorldWind Stealer/stub.dll family_stormkitty - Stormkitty family
File Explorer
-
WorldWind Stealer.zip.zip 1.1MB
-
WorldWind Stealer/Builder WorldWind Pro.exe.exe 416KB
-
WorldWind Stealer/DotNetZip.dll.dll 448KB
-
WorldWind Stealer/Extreme.Net.dll.dll 121KB
-
WorldWind Stealer/MetroFramework.Design.dll.dll 16KB
-
WorldWind Stealer/MetroFramework.Fonts.dll.dll 656KB
-
WorldWind Stealer/MetroFramework.dll.dll 313KB
-
WorldWind Stealer/Mono.Cecil.dll.dll 273KB
-
WorldWind Stealer/stub.dll.exe 169KB
WorldWind Stealer/Builder WorldWind Pro.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e0e74379954acb4d9847c0cfb63e8a4028217d859c74ad97b40504627277d16b
- MD5 5e503d24ca178db83e5d931990c1baa6
- SHA1 4873707dde8e39da9898dd324a5912d2a30482c6
- SHA512 3bd9474ee1dfc2fe2acd1c22518f10b13b938ef19fafa2fd540ca650533508f3aa66fa17cba43a70aa9eeba6b6ab4bdb5724262e869187756f5a721b38214f68
- SSDEEP 6144:ngZe/liHHaPp0sCHjiJ6zRLszGvPi+XD6ztQK9UXIV/xIl6pLTcDaWfCG1kDuf:gZCina7J6KGvq+z6eynpLlWfCGqi
- MD5 SHA1 SHA512 SSDEEP
Minor OS version
Major OS version
Entry point
344814
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
329KB
Virtual Size
328KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WorldWind Stealer/DotNetZip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 00da1597d92235d3f84da979e2fa5dbf049bafb52c33bd6fc8ee7b29570c124c
- MD5 6d1c62ec1c2ef722f49b2d8dd4a4df16
- SHA1 1bb08a979b7987bc7736a8cfa4779383cb0ecfa6
- SHA512 c0dce8eaa52eb6c319d4be2eec4622bb3380c65b659cfb77ff51a4ada7d3e591e791ee823dad67b5556ffac5c060ff45d09dd1cc21baaf70ba89806647cb3bd2
- SSDEEP 6144:FuCIjOL8qwWN/jMlC/XiapWSu9vnITVxGtSV41kJDsTDD5rlGe6wfxLV/7:dZLJLdvOSsnjS4csBrge6sf7
- MD5 SHA1 SHA512 SSDEEP
Minor OS version
Major OS version
Entry point
453046
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorDllMain
Name
.text
Size
446KB
Virtual Size
445KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WorldWind Stealer/Extreme.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8a6518ab7419fbec3ac9875baa3afb410ad1398c7aa622a09cd9084ec6cadfcd
- MD5 f79f0e3a0361cac000e2d3553753cd68
- SHA1 4314bcef76fddc9379a8f3a266b37d685d0adb79
- SHA512 c77516e7f5540ecd13fa5d8cecfce34629acecd9b5a445f5f48902c9e823328fa9a6694ecaa39f5b6053de61c2b850c2d87df25357548afaad6ec37eb3e5e355
- SSDEEP 3072:bdoECIgjBibgp2tBqL0Y++ruXqMG4ih3lbpMqc:bdoECIgUrG
- MD5 SHA1 SHA512 SSDEEP
Minor OS version
Major OS version
Entry point
129182
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorDllMain
Name
.text
Size
118KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WorldWind Stealer/MetroFramework.Design.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 28089707733c92c7fade97e7b6fab4007e7b8bfd6dc7a8526a3ea597f1a30845
- MD5 c853e9e8c720249198ff376f42328ef9
- SHA1 a56ee195148023571e26ffeaa5a736bc73a76c40
- SHA512 d21cf5cfe0a5e2f7d4c128e64e0decee28028297c804319fb957b1f0e60d62e3103976b95abc3d2bd5ba66801cb5fe9bef4bae067273079177be28c73132c739
- SSDEEP 384:k1q4fJwcRJTxK0JLBamLGqPkO9V1VFf5L7W1OYKjbq9w:6q4hwcRBJLBamSqPkO9V1ViGq9
- MD5 SHA1 SHA512 SSDEEP
Minor OS version
Major OS version
Entry point
22126
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WorldWind Stealer/MetroFramework.Fonts.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 15a605129cac3663ba1ddb98f5798334fba5e7954ee36a69727299b4e366c2eb
- MD5 b8c8a532438c4b421081efb258355469
- SHA1 41aa88d5eaf398da55f712f30226b70492125be1
- SHA512 511070c8cfe018e60e11d495393152e10aa2aa0c08cde84678ef3a0efd63ae5c562a47bfab883f4babd469b1873127bacc9c986cb2bc096985176f1dbf93b1fc
- SSDEEP 12288:5+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:5+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
- MD5 SHA1 SHA512 SSDEEP
Minor OS version
Major OS version
Entry point
677454
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorDllMain
Name
.text
Size
654KB
Virtual Size
653KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WorldWind Stealer/MetroFramework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9e58f13deb328455f216f165588b5f5111ecd12042d7dd196686dfb0f0fc68eb
- MD5 b20f1b5e3d4e3df2d826e9870637cd06
- SHA1 a03bb47afdf9498be409ed5b56e945f6e143fb32
- SHA512 095c5956ebc114c4b380d2b43981bcabd221782530328a51cb2c6aec05a016dad2e5efae36810f6840611f77f589be1e1e7f2200738df3bca222381837033b2d
- SSDEEP 6144:Ys+J/PxfbpAQ1bZHE7Zhm6uOw0g749O2:qJ/PxzpAObhV6uO99O
- MD5 SHA1 SHA512 SSDEEP
Minor OS version
Major OS version
Entry point
326366
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorDllMain
Name
.text
Size
311KB
Virtual Size
310KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WorldWind Stealer/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1a1565804348c2e621e0a509cedaa516eeb7e9fadfbeefe58e1e9cf8ec16b915
- MD5 80ea4bfe7944e2f384d97488c83d9d25
- SHA1 18789622bdff9d99683504faf2a302a194e3b6c0
- SHA512 561e8c8465c1989dcc6c03b221f24c0f5c0ee278ff244d171f1761c79ee83debcb00973e2027be28ae77e47956a192b2a4a019e83b2802c62639f5d375aabe5b
- SSDEEP 6144:P0eCY7BUB5SH41/sE0oWZSSCvXb9PKdJDkPWeUP:syK7t1EKWZS1vXbw
- MD5 SHA1 SHA512 SSDEEP
Minor OS version
Major OS version
Entry point
285262
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorDllMain
Name
.text
Size
271KB
Virtual Size
270KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WorldWind Stealer/stub.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ec3aa251b8fc99c510f9f6f7d59bfe57f1b79d925d3e5faa0e2e08610597fe09
- MD5 fa88f24eab7de6a32660b75bb72352cb
- SHA1 21b557154d87ddc57949d51838b1c18e5582a068
- SHA512 f01ec8bb73467e01715fd877b4b168974f078e03e69c7b3c379eb8f9798531ffa9a496b2c8e348de2f31dbf01acb4a122a681b98f443c6d9d2ac27faa68acba7
- SSDEEP 3072:UySRwk/N2wtuh77yHcokLZl4JLrBt6qIPu/i9bVK2cvwAuY+Wpu:FkV9tuh77ypkLTaPr6XPSi9b43
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
StormKitty payload
Minor OS version
Major OS version
Entry point
178942
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
167KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ