Overview

overview

10

Static

static

10

DigiSparkS.../a.exe

windows7-x64

9

DigiSparkS.../a.exe

windows10-2004-x64

9

DigiSparkS...un.ps1

windows7-x64

1

DigiSparkS...un.ps1

windows10-2004-x64

1

DigiSparkS...nd.bat

windows7-x64

10

DigiSparkS...nd.bat

windows10-2004-x64

10

DigiSparkS...xe.ps1

windows7-x64

8

DigiSparkS...xe.ps1

windows10-2004-x64

8

DigiSparkS...ier.py

windows7-x64

3

DigiSparkS...ier.py

windows10-2004-x64

3

DigiSparkS...ium.py

windows7-x64

3

DigiSparkS...ium.py

windows10-2004-x64

3

DigiSparkS...ser.py

windows7-x64

3

DigiSparkS...ser.py

windows10-2004-x64

3

DigiSparkS...mac.py

windows7-x64

3

DigiSparkS...mac.py

windows10-2004-x64

3

DigiSparkS...ain.py

windows7-x64

3

DigiSparkS...ain.py

windows10-2004-x64

3

DigiSparkS...tlm.py

windows7-x64

3

DigiSparkS...tlm.py

windows10-2004-x64

3

DigiSparkS...ail.py

windows7-x64

3

DigiSparkS...ail.py

windows10-2004-x64

3

DigiSparkS...ifi.py

windows7-x64

3

DigiSparkS...ifi.py

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    DigiSparkStealer-master.zip

  • Size

    167KB

  • MD5

    f5d3da564ace1a4463033164a20ba3ef

  • SHA1

    d9a87ae20650b8d40f88073a09f617b79287a302

  • SHA256

    52f602b095693ac2f809155033fa05d81c8f816f695a2f21a8751c37f822d218

  • SHA512

    847808ee4c64e8f0007f8eba8056e399aa04223c16667f6483c27565b9e8e011a2934ed71a380a7f861b721707efe93602a3bd7bcf311fb2c49d77eccc0b4ecd

  • SSDEEP

    3072:r1u24qGov3dgOKEJRszZsTvVXj0pWDtS5QG1FvsTyBT4+L0qfmblp9RVPhk/DfHW:rT4q/vNgOKA84TiWU5QG1ZGyZhAj3VPX

Score
10/10
upx

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://download.sysinternals.com/files/Procdump.zip
exe.dropper

https://vk.com/doc138418519_492631985

Signatures

  • Nirsoft 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • DigiSparkStealer-master.zip
    .zip

    Password: infected

  • DigiSparkStealer-master/.gitignore
  • DigiSparkStealer-master/LICENSE
  • DigiSparkStealer-master/README.md
  • DigiSparkStealer-master/_nirsoft/a.exe
    .exe windows x86

    Password: infected


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections

  • DigiSparkStealer-master/_nirsoft/nirsoft_run.ino
    .ps1
  • DigiSparkStealer-master/arduino_source/sketch/sketch.ino
  • DigiSparkStealer-master/docs/example.png
    .png
  • DigiSparkStealer-master/powershell_source/cmd_command.bat
  • DigiSparkStealer-master/powershell_source/download_exe.ps1
    .ps1
  • DigiSparkStealer-master/python_source/beautifier.py
  • DigiSparkStealer-master/python_source/chromium.py
  • DigiSparkStealer-master/python_source/cookiesParser.py
  • DigiSparkStealer-master/python_source/mac.py
  • DigiSparkStealer-master/python_source/main.py
  • DigiSparkStealer-master/python_source/ntlm.py
  • DigiSparkStealer-master/python_source/sendMail.py
  • DigiSparkStealer-master/python_source/wifi.py