882315923e9235e760ace75598298df0e14de154e3023c7550afda43f9dadaf0[.]zip[.]zip

resource	yara_rule
static1/unpack002/UFR_Stealer/ready/v2.0.2.0/UFR_Stealer.exe	upx
static1/unpack002/UFR_Stealer/upx_bin/upx.exe	upx

resource
unpack002/UFR_Stealer/EmbeddedSQLite3/resource/32bits/sqlite3.dll
unpack002/UFR_Stealer/STG/COFF2OMF.EXE
unpack002/UFR_Stealer/ready/v2.0.2.0/UFR_Stealer.exe
unpack002/UFR_Stealer/upx_bin/upx.exe

882315923e9235e760ace75598298df0e14de154e3023c7550afda43f9dadaf0.zip.zip

.zip

Password: infected

882315923e9235e760ace75598298df0e14de154e3023c7550afda43f9dadaf0.zip

.zip

UFR_Stealer/Antis.dcu

UFR_Stealer/Antis.dfm

UFR_Stealer/Antis.pas

UFR_Stealer/BTMemoryModule/BTMemoryModule.dcu

UFR_Stealer/BTMemoryModule/BTMemoryModule.pas

.js

UFR_Stealer/BTMemoryModule/license.txt

UFR_Stealer/CRC32.dcu

UFR_Stealer/CRC32.pas

UFR_Stealer/CRCunit.dcu

UFR_Stealer/CRCunit.pas

UFR_Stealer/DCPCrypt2/Ciphers/DCPblowfish.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPblowfish.inc

UFR_Stealer/DCPCrypt2/Ciphers/DCPblowfish.pas

UFR_Stealer/DCPCrypt2/Ciphers/DCPcast128.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPcast128.inc

UFR_Stealer/DCPCrypt2/Ciphers/DCPcast128.pas

UFR_Stealer/DCPCrypt2/Ciphers/DCPcast256.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPcast256.inc

UFR_Stealer/DCPCrypt2/Ciphers/DCPcast256.pas

UFR_Stealer/DCPCrypt2/Ciphers/DCPdes.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPdes.inc

UFR_Stealer/DCPCrypt2/Ciphers/DCPdes.pas

.js

UFR_Stealer/DCPCrypt2/Ciphers/DCPgost.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPgost.inc

UFR_Stealer/DCPCrypt2/Ciphers/DCPgost.pas

UFR_Stealer/DCPCrypt2/Ciphers/DCPice.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPice.pas

UFR_Stealer/DCPCrypt2/Ciphers/DCPidea.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPidea.pas

UFR_Stealer/DCPCrypt2/Ciphers/DCPmars.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPmars.inc

UFR_Stealer/DCPCrypt2/Ciphers/DCPmars.pas

UFR_Stealer/DCPCrypt2/Ciphers/DCPmisty1.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPmisty1.inc

UFR_Stealer/DCPCrypt2/Ciphers/DCPmisty1.pas

UFR_Stealer/DCPCrypt2/Ciphers/DCPrc2.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPrc2.inc

UFR_Stealer/DCPCrypt2/Ciphers/DCPrc2.pas

UFR_Stealer/DCPCrypt2/Ciphers/DCPrc4.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPrc4.pas

.js

UFR_Stealer/DCPCrypt2/Ciphers/DCPrc5.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPrc5.pas

UFR_Stealer/DCPCrypt2/Ciphers/DCPrc6.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPrc6.pas

UFR_Stealer/DCPCrypt2/Ciphers/DCPrijndael.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPrijndael.inc

UFR_Stealer/DCPCrypt2/Ciphers/DCPrijndael.pas

UFR_Stealer/DCPCrypt2/Ciphers/DCPserpent.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPserpent.pas

UFR_Stealer/DCPCrypt2/Ciphers/DCPtea.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPtea.pas

UFR_Stealer/DCPCrypt2/Ciphers/DCPtwofish.dcu

UFR_Stealer/DCPCrypt2/Ciphers/DCPtwofish.inc

UFR_Stealer/DCPCrypt2/Ciphers/DCPtwofish.pas

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~10~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~11~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~12~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~13~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~14~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~15~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~16~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~17~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~18~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~19~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~1~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~20~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~21~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~22~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~23~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~24~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~25~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~26~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~27~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~28~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~29~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~2~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~30~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~31~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~32~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~33~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~34~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~35~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~36~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~37~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~38~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~39~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~3~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~40~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~41~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~42~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~43~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~44~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~45~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~46~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~47~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~48~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~49~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~4~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~50~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~51~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~52~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~53~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~54~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~55~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~56~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~57~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~58~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~59~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~5~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~60~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~61~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~62~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~63~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~64~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~65~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~6~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~7~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~8~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPblowfish.pas.~9~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPrijndael.pas.~1~

UFR_Stealer/DCPCrypt2/Ciphers/__history/DCPrijndael.pas.~2~

UFR_Stealer/DCPCrypt2/DCPbase64.dcu

UFR_Stealer/DCPCrypt2/DCPbase64.pas

UFR_Stealer/DCPCrypt2/DCPblockciphers.dcu

UFR_Stealer/DCPCrypt2/DCPblockciphers.pas

.js

UFR_Stealer/DCPCrypt2/DCPciphers.dcr

UFR_Stealer/DCPCrypt2/DCPconst.dcu

UFR_Stealer/DCPCrypt2/DCPconst.pas

UFR_Stealer/DCPCrypt2/DCPcppbuilder5.bpk

.xml

UFR_Stealer/DCPCrypt2/DCPcppbuilder5.cpp

UFR_Stealer/DCPCrypt2/DCPcppbuilder5.res

UFR_Stealer/DCPCrypt2/DCPcrypt2.dcu

UFR_Stealer/DCPCrypt2/DCPcrypt2.pas

.js

UFR_Stealer/DCPCrypt2/DCPdelphi4.cfg

UFR_Stealer/DCPCrypt2/DCPdelphi4.dof

UFR_Stealer/DCPCrypt2/DCPdelphi4.dpk

UFR_Stealer/DCPCrypt2/DCPdelphi4.res

UFR_Stealer/DCPCrypt2/DCPdelphi5.cfg

UFR_Stealer/DCPCrypt2/DCPdelphi5.dof

UFR_Stealer/DCPCrypt2/DCPdelphi5.dpk

UFR_Stealer/DCPCrypt2/DCPdelphi5.res

UFR_Stealer/DCPCrypt2/DCPdelphi6.bdsproj

UFR_Stealer/DCPCrypt2/DCPdelphi6.bdsproj.local

UFR_Stealer/DCPCrypt2/DCPdelphi6.cfg

UFR_Stealer/DCPCrypt2/DCPdelphi6.dcu

UFR_Stealer/DCPCrypt2/DCPdelphi6.dof

UFR_Stealer/DCPCrypt2/DCPdelphi6.dpk

UFR_Stealer/DCPCrypt2/DCPdelphi6.res

UFR_Stealer/DCPCrypt2/DCPhashes.dcr

UFR_Stealer/DCPCrypt2/DCPkylix.conf

UFR_Stealer/DCPCrypt2/DCPkylix.dpk

UFR_Stealer/DCPCrypt2/DCPkylix.kof

UFR_Stealer/DCPCrypt2/DCPkylix.res

UFR_Stealer/DCPCrypt2/DCPreg.dcu

UFR_Stealer/DCPCrypt2/DCPreg.pas

UFR_Stealer/DCPCrypt2/Docs/BlockCiphers.html

.html .js

UFR_Stealer/DCPCrypt2/Docs/Ciphers.html

.html .js

UFR_Stealer/DCPCrypt2/Docs/Hashes.html

.html

UFR_Stealer/DCPCrypt2/Docs/Index.html

.html

UFR_Stealer/DCPCrypt2/Docs/MIT_license.txt

UFR_Stealer/DCPCrypt2/Docs/osi-certified-120x100.png

.png

UFR_Stealer/DCPCrypt2/Hashes/DCPhaval.dcu

UFR_Stealer/DCPCrypt2/Hashes/DCPhaval.pas

UFR_Stealer/DCPCrypt2/Hashes/DCPhaval3.inc

UFR_Stealer/DCPCrypt2/Hashes/DCPhaval4.inc

UFR_Stealer/DCPCrypt2/Hashes/DCPhaval5.inc

UFR_Stealer/DCPCrypt2/Hashes/DCPmd4.dcu

UFR_Stealer/DCPCrypt2/Hashes/DCPmd4.pas

UFR_Stealer/DCPCrypt2/Hashes/DCPmd5.dcu

UFR_Stealer/DCPCrypt2/Hashes/DCPmd5.pas

UFR_Stealer/DCPCrypt2/Hashes/DCPripemd128.dcu

UFR_Stealer/DCPCrypt2/Hashes/DCPripemd128.pas

UFR_Stealer/DCPCrypt2/Hashes/DCPripemd160.dcu

UFR_Stealer/DCPCrypt2/Hashes/DCPripemd160.pas

UFR_Stealer/DCPCrypt2/Hashes/DCPsha1.dcu

UFR_Stealer/DCPCrypt2/Hashes/DCPsha1.pas

UFR_Stealer/DCPCrypt2/Hashes/DCPsha256.dcu

UFR_Stealer/DCPCrypt2/Hashes/DCPsha256.pas

UFR_Stealer/DCPCrypt2/Hashes/DCPsha512.dcu

UFR_Stealer/DCPCrypt2/Hashes/DCPsha512.pas

UFR_Stealer/DCPCrypt2/Hashes/DCPtiger.dcu

UFR_Stealer/DCPCrypt2/Hashes/DCPtiger.inc

UFR_Stealer/DCPCrypt2/Hashes/DCPtiger.pas

UFR_Stealer/DCPCrypt2/Readme.txt

UFR_Stealer/DCPCrypt2/__history/DCPcrypt2.pas.~1~

.js

UFR_Stealer/DCPCrypt2/__history/DCPcrypt2.pas.~2~

.js

UFR_Stealer/DCPCrypt2/__history/DCPcrypt2.pas.~3~

.js

UFR_Stealer/DCPCrypt2/__history/DCPcrypt2.pas.~4~

.js

UFR_Stealer/DCPCrypt2/__history/DCPcrypt2.pas.~5~

.js

UFR_Stealer/DCPCrypt2/__history/DCPcrypt2.pas.~6~

.js

UFR_Stealer/DELETED/FilesGrabForm.dcu

UFR_Stealer/DELETED/FilesGrabForm.dfm

UFR_Stealer/DELETED/FilesGrabForm.pas

UFR_Stealer/DELETED/Monitor_FTP.dcu

UFR_Stealer/DELETED/Monitor_FTP.pas

UFR_Stealer/DELETED/NotificationForm.dcu

UFR_Stealer/DELETED/NotificationForm.dfm

UFR_Stealer/DELETED/NotificationForm.pas

UFR_Stealer/DELETED/RegGrabForm.dcu

UFR_Stealer/DELETED/RegGrabForm.dfm

UFR_Stealer/DELETED/RegGrabForm.pas

UFR_Stealer/DecryptorGeneracion.dcu

UFR_Stealer/DecryptorGeneracion.pas

UFR_Stealer/Dloader.dcu

UFR_Stealer/Dloader.dfm

UFR_Stealer/Dloader.pas

UFR_Stealer/ETG/ETG.OBJ

UFR_Stealer/ETG/ETG.asm

UFR_Stealer/ETG/ETG.dcu

UFR_Stealer/ETG/ETG.pas

UFR_Stealer/ETG/MAKE_IT.bat

UFR_Stealer/ETG/__history/ETG.pas.~10~

UFR_Stealer/ETG/__history/ETG.pas.~11~

UFR_Stealer/ETG/__history/ETG.pas.~12~

UFR_Stealer/ETG/__history/ETG.pas.~13~

UFR_Stealer/ETG/__history/ETG.pas.~14~

UFR_Stealer/ETG/__history/ETG.pas.~15~

UFR_Stealer/ETG/__history/ETG.pas.~16~

UFR_Stealer/ETG/__history/ETG.pas.~17~

UFR_Stealer/ETG/__history/ETG.pas.~18~

UFR_Stealer/ETG/__history/ETG.pas.~19~

UFR_Stealer/ETG/__history/ETG.pas.~1~

UFR_Stealer/ETG/__history/ETG.pas.~20~

UFR_Stealer/ETG/__history/ETG.pas.~21~

UFR_Stealer/ETG/__history/ETG.pas.~22~

UFR_Stealer/ETG/__history/ETG.pas.~23~

UFR_Stealer/ETG/__history/ETG.pas.~24~

UFR_Stealer/ETG/__history/ETG.pas.~25~

UFR_Stealer/ETG/__history/ETG.pas.~26~

UFR_Stealer/ETG/__history/ETG.pas.~27~

UFR_Stealer/ETG/__history/ETG.pas.~28~

UFR_Stealer/ETG/__history/ETG.pas.~29~

UFR_Stealer/ETG/__history/ETG.pas.~2~

UFR_Stealer/ETG/__history/ETG.pas.~30~

UFR_Stealer/ETG/__history/ETG.pas.~31~

UFR_Stealer/ETG/__history/ETG.pas.~32~

UFR_Stealer/ETG/__history/ETG.pas.~33~

UFR_Stealer/ETG/__history/ETG.pas.~34~

UFR_Stealer/ETG/__history/ETG.pas.~35~

UFR_Stealer/ETG/__history/ETG.pas.~36~

UFR_Stealer/ETG/__history/ETG.pas.~37~

UFR_Stealer/ETG/__history/ETG.pas.~38~

UFR_Stealer/ETG/__history/ETG.pas.~39~

UFR_Stealer/ETG/__history/ETG.pas.~3~

UFR_Stealer/ETG/__history/ETG.pas.~40~

UFR_Stealer/ETG/__history/ETG.pas.~41~

UFR_Stealer/ETG/__history/ETG.pas.~42~

UFR_Stealer/ETG/__history/ETG.pas.~43~

UFR_Stealer/ETG/__history/ETG.pas.~44~

UFR_Stealer/ETG/__history/ETG.pas.~45~

UFR_Stealer/ETG/__history/ETG.pas.~46~

UFR_Stealer/ETG/__history/ETG.pas.~47~

UFR_Stealer/ETG/__history/ETG.pas.~48~

UFR_Stealer/ETG/__history/ETG.pas.~49~

UFR_Stealer/ETG/__history/ETG.pas.~4~

UFR_Stealer/ETG/__history/ETG.pas.~5~

UFR_Stealer/ETG/__history/ETG.pas.~6~

UFR_Stealer/ETG/__history/ETG.pas.~7~

UFR_Stealer/ETG/__history/ETG.pas.~8~

UFR_Stealer/ETG/__history/ETG.pas.~9~

UFR_Stealer/EmbeddedSQLite3/resource/32bits/sqlite3.dll

.dll windows:4 windows x86

e9d751eae4ee6793173f90f7b74d8d2d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

AreFileApisANSI

CloseHandle

CreateFileA

CreateFileMappingA

CreateFileMappingW

CreateFileW

CreateMutexW

DeleteCriticalSection

DeleteFileA

DeleteFileW

EnterCriticalSection

FlushFileBuffers

FormatMessageA

FormatMessageW

FreeLibrary

GetCurrentProcessId

GetDiskFreeSpaceA

GetDiskFreeSpaceW

GetFileAttributesA

GetFileAttributesExW

GetFileAttributesW

GetFileSize

GetFullPathNameA

GetFullPathNameW

GetLastError

GetModuleHandleA

GetProcAddress

GetSystemInfo

GetSystemTime

GetSystemTimeAsFileTime

GetTempPathA

GetTempPathW

GetTickCount

GetVersionExA

HeapAlloc

HeapCreate

HeapDestroy

HeapFree

HeapReAlloc

HeapSize

HeapValidate

InitializeCriticalSection

InterlockedCompareExchange

LeaveCriticalSection

LoadLibraryA

LoadLibraryW

LocalFree

LockFile

LockFileEx

MapViewOfFile

MultiByteToWideChar

QueryPerformanceCounter

ReadFile

SetEndOfFile

SetFilePointer

Sleep

SystemTimeToFileTime

TlsGetValue

UnlockFile

UnlockFileEx

UnmapViewOfFile

VirtualProtect

VirtualQuery

WideCharToMultiByte

WriteFile

msvcrt

__dllonexit

_errno

_iob

_winmajor

abort

calloc

fflush

free

fwrite

localtime

malloc

memcmp

memmove

memset

qsort

realloc

strcmp

strncmp

vfprintf

Exports

sqlite3_aggregate_context

sqlite3_aggregate_count

sqlite3_auto_extension

sqlite3_backup_finish

sqlite3_backup_init

sqlite3_backup_pagecount

sqlite3_backup_remaining

sqlite3_backup_step

sqlite3_bind_blob

sqlite3_bind_double

sqlite3_bind_int

sqlite3_bind_int64

sqlite3_bind_null

sqlite3_bind_parameter_count

sqlite3_bind_parameter_index

sqlite3_bind_parameter_name

sqlite3_bind_text

sqlite3_bind_text16

sqlite3_bind_value

sqlite3_bind_zeroblob

sqlite3_blob_bytes

sqlite3_blob_close

sqlite3_blob_open

sqlite3_blob_read

sqlite3_blob_reopen

sqlite3_blob_write

sqlite3_busy_handler

sqlite3_busy_timeout

sqlite3_changes

sqlite3_clear_bindings

sqlite3_close

sqlite3_collation_needed

sqlite3_collation_needed16

sqlite3_column_blob

sqlite3_column_bytes

sqlite3_column_bytes16

sqlite3_column_count

sqlite3_column_database_name

sqlite3_column_database_name16

sqlite3_column_decltype

sqlite3_column_decltype16

sqlite3_column_double

sqlite3_column_int

sqlite3_column_int64

sqlite3_column_name

sqlite3_column_name16

sqlite3_column_origin_name

sqlite3_column_origin_name16

sqlite3_column_table_name

sqlite3_column_table_name16

sqlite3_column_text

sqlite3_column_text16

sqlite3_column_type

sqlite3_column_value

sqlite3_commit_hook

sqlite3_compileoption_get

sqlite3_compileoption_used

sqlite3_complete

sqlite3_complete16

sqlite3_config

sqlite3_context_db_handle

sqlite3_create_collation

sqlite3_create_collation16

sqlite3_create_collation_v2

sqlite3_create_function

sqlite3_create_function16

sqlite3_create_function_v2

sqlite3_create_module

sqlite3_create_module_v2

sqlite3_data_count

sqlite3_db_config

sqlite3_db_filename

sqlite3_db_handle

sqlite3_db_mutex

sqlite3_db_readonly

sqlite3_db_release_memory

sqlite3_db_status

sqlite3_declare_vtab

sqlite3_enable_load_extension

sqlite3_enable_shared_cache

sqlite3_errcode

sqlite3_errmsg

sqlite3_errmsg16

sqlite3_exec

sqlite3_expired

sqlite3_extended_errcode

sqlite3_extended_result_codes

sqlite3_file_control

sqlite3_finalize

sqlite3_free

sqlite3_free_table

sqlite3_get_autocommit

sqlite3_get_auxdata

sqlite3_get_table

sqlite3_global_recover

sqlite3_initialize

sqlite3_interrupt

sqlite3_last_insert_rowid

sqlite3_libversion

sqlite3_libversion_number

sqlite3_limit

sqlite3_load_extension

sqlite3_log

sqlite3_malloc

sqlite3_memory_alarm

sqlite3_memory_highwater

sqlite3_memory_used

sqlite3_mprintf

sqlite3_mutex_alloc

sqlite3_mutex_enter

sqlite3_mutex_free

sqlite3_mutex_leave

sqlite3_mutex_try

sqlite3_next_stmt

sqlite3_open

sqlite3_open16

sqlite3_open_v2

sqlite3_os_end

sqlite3_os_init

sqlite3_overload_function

sqlite3_prepare

sqlite3_prepare16

sqlite3_prepare16_v2

sqlite3_prepare_v2

sqlite3_profile

sqlite3_progress_handler

sqlite3_randomness

sqlite3_realloc

sqlite3_release_memory

sqlite3_reset

sqlite3_reset_auto_extension

sqlite3_result_blob

sqlite3_result_double

sqlite3_result_error

sqlite3_result_error16

sqlite3_result_error_code

sqlite3_result_error_nomem

sqlite3_result_error_toobig

sqlite3_result_int

sqlite3_result_int64

sqlite3_result_null

sqlite3_result_text

sqlite3_result_text16

sqlite3_result_text16be

sqlite3_result_text16le

sqlite3_result_value

sqlite3_result_zeroblob

sqlite3_rollback_hook

sqlite3_rtree_geometry_callback

sqlite3_set_authorizer

sqlite3_set_auxdata

sqlite3_shutdown

sqlite3_sleep

sqlite3_snprintf

sqlite3_soft_heap_limit

sqlite3_soft_heap_limit64

sqlite3_sourceid

sqlite3_sql

sqlite3_status

sqlite3_step

sqlite3_stmt_busy

sqlite3_stmt_readonly

sqlite3_stmt_status

sqlite3_stricmp

sqlite3_strnicmp

sqlite3_table_column_metadata

sqlite3_test_control

sqlite3_thread_cleanup

sqlite3_threadsafe

sqlite3_total_changes

sqlite3_trace

sqlite3_transfer_bindings

sqlite3_update_hook

sqlite3_uri_boolean

sqlite3_uri_int64

sqlite3_uri_parameter

sqlite3_user_data

sqlite3_value_blob

sqlite3_value_bytes

sqlite3_value_bytes16

sqlite3_value_double

sqlite3_value_int

sqlite3_value_int64

sqlite3_value_numeric_type

sqlite3_value_text

sqlite3_value_text16

sqlite3_value_text16be

sqlite3_value_text16le

sqlite3_value_type

sqlite3_vfs_find

sqlite3_vfs_register

sqlite3_vfs_unregister

sqlite3_vmprintf

sqlite3_vsnprintf

sqlite3_vtab_config

sqlite3_vtab_on_conflict

sqlite3_wal_autocheckpoint

sqlite3_wal_checkpoint

sqlite3_wal_checkpoint_v2

IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

UFR_Stealer/EmbeddedSQLite3/resource/sqlite3dll32.rc

UFR_Stealer/EmbeddedSQLite3/resource/sqlite3dll32.res

UFR_Stealer/EmbeddedSQLite3/resource/sqlite3dll64.rc

UFR_Stealer/EmbeddedSQLite3/source/SQLite3Classes.dcu

UFR_Stealer/EmbeddedSQLite3/source/SQLite3Classes.pas

UFR_Stealer/EmbeddedSQLite3/source/SQLite3Constants.dcu

UFR_Stealer/EmbeddedSQLite3/source/SQLite3Constants.pas

UFR_Stealer/EmbeddedSQLite3/source/SQLite3Lib.dcu

UFR_Stealer/EmbeddedSQLite3/source/SQLite3Lib.pas

.js

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Classes.pas.~354~

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Classes.pas.~355~

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Classes.pas.~356~

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Classes.pas.~357~

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Classes.pas.~358~

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Classes.pas.~359~

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Classes.pas.~360~

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Classes.pas.~361~

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Classes.pas.~362~

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Classes.pas.~363~

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Constants.pas.~1~

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Lib.pas.~76~

.js

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Lib.pas.~77~

.js

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Lib.pas.~78~

.js

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Lib.pas.~79~

.js

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Lib.pas.~80~

.js

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Lib.pas.~81~

.js

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Lib.pas.~82~

.js

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Lib.pas.~83~

.js

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Lib.pas.~84~

.js

UFR_Stealer/EmbeddedSQLite3/source/__history/SQLite3Lib.pas.~85~

.js

UFR_Stealer/EmbeddedSQLite3/source/sqlite3dll32.res

UFR_Stealer/FlashUseForm.dcu

UFR_Stealer/FlashUseForm.dfm

UFR_Stealer/FlashUseForm.pas

UFR_Stealer/FtpUseForm.dcu

UFR_Stealer/FtpUseForm.dfm

UFR_Stealer/FtpUseForm.pas

UFR_Stealer/GFX_About.dcu

UFR_Stealer/GFX_About.dfm

UFR_Stealer/GFX_About.pas

UFR_Stealer/GateFiles/build.bat

UFR_Stealer/GateFiles/gate.RES

UFR_Stealer/GateFiles/gate.rc

UFR_Stealer/GateFiles/ufr.php

UFR_Stealer/GateUseForm.dcu

UFR_Stealer/GateUseForm.dfm

UFR_Stealer/GateUseForm.pas

UFR_Stealer/HELP/Help.html

UFR_Stealer/HELP/build.bat

UFR_Stealer/HELP/help.RES

UFR_Stealer/HELP/help.rc

UFR_Stealer/JoinForm.dcu

UFR_Stealer/JoinForm.dfm

UFR_Stealer/JoinForm.pas

UFR_Stealer/LDasm/LDasm.dcu

UFR_Stealer/LDasm/LDasm.pas

UFR_Stealer/MailUseForm.dcu

UFR_Stealer/MailUseForm.dfm

UFR_Stealer/MailUseForm.pas

UFR_Stealer/Parser.dcu

UFR_Stealer/Parser.pas

UFR_Stealer/PwdEnterForm.dcu

UFR_Stealer/PwdEnterForm.dfm

UFR_Stealer/PwdEnterForm.pas

UFR_Stealer/PwdProtectReportUseForm.dcu

UFR_Stealer/PwdProtectReportUseForm.dfm

UFR_Stealer/PwdProtectReportUseForm.pas

UFR_Stealer/RESOURCES.PAS

UFR_Stealer/RESOURCES.dcu

UFR_Stealer/STG/COFF2OMF.EXE

.exe windows:4 windows x86

cf8e0ccf58d649ba0227a27de13bc86e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoA

GetFileTime

FindFirstFileA

FindClose

FindNextFileA

GetLastError

MoveFileA

DeleteFileA

WriteFile

HeapFree

HeapAlloc

ReadFile

SetFilePointer

CloseHandle

ExitProcess

TerminateProcess

GetCurrentProcess

GetFileType

CreateFileA

SetStdHandle

GetFullPathNameA

GetCommandLineA

GetVersion

SetHandleCount

GetStdHandle

SetFileTime

HeapDestroy

HeapCreate

VirtualFree

VirtualAlloc

SetEndOfFile

GetCPInfo

GetACP

GetOEMCP

GetCurrentDirectoryA

GetDriveTypeA

MultiByteToWideChar

WideCharToMultiByte

LCMapStringA

LCMapStringW

GetStringTypeA

GetStringTypeW

UnhandledExceptionFilter

GetModuleFileNameA

FreeEnvironmentStringsA

FreeEnvironmentStringsW

GetEnvironmentStrings

GetEnvironmentStringsW

RtlUnwind

FlushFileBuffers

GetProcAddress

LoadLibraryA

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

UFR_Stealer/STG/__history/trashgen_lib.pas.~10~

UFR_Stealer/STG/__history/trashgen_lib.pas.~11~

UFR_Stealer/STG/__history/trashgen_lib.pas.~12~

UFR_Stealer/STG/__history/trashgen_lib.pas.~13~

UFR_Stealer/STG/__history/trashgen_lib.pas.~14~

UFR_Stealer/STG/__history/trashgen_lib.pas.~15~

UFR_Stealer/STG/__history/trashgen_lib.pas.~16~

UFR_Stealer/STG/__history/trashgen_lib.pas.~17~

UFR_Stealer/STG/__history/trashgen_lib.pas.~18~

UFR_Stealer/STG/__history/trashgen_lib.pas.~19~

UFR_Stealer/STG/__history/trashgen_lib.pas.~1~

UFR_Stealer/STG/__history/trashgen_lib.pas.~20~

UFR_Stealer/STG/__history/trashgen_lib.pas.~21~

UFR_Stealer/STG/__history/trashgen_lib.pas.~22~

UFR_Stealer/STG/__history/trashgen_lib.pas.~23~

UFR_Stealer/STG/__history/trashgen_lib.pas.~24~

UFR_Stealer/STG/__history/trashgen_lib.pas.~25~

UFR_Stealer/STG/__history/trashgen_lib.pas.~26~

UFR_Stealer/STG/__history/trashgen_lib.pas.~27~

UFR_Stealer/STG/__history/trashgen_lib.pas.~2~

UFR_Stealer/STG/__history/trashgen_lib.pas.~3~

UFR_Stealer/STG/__history/trashgen_lib.pas.~4~

UFR_Stealer/STG/__history/trashgen_lib.pas.~5~

UFR_Stealer/STG/__history/trashgen_lib.pas.~6~

UFR_Stealer/STG/__history/trashgen_lib.pas.~7~

UFR_Stealer/STG/__history/trashgen_lib.pas.~8~

UFR_Stealer/STG/__history/trashgen_lib.pas.~9~

UFR_Stealer/STG/build.bat

UFR_Stealer/STG/tg.o

UFR_Stealer/STG/trashgen.asm

UFR_Stealer/STG/trashgen_lib.dcu

UFR_Stealer/STG/trashgen_lib.pas

UFR_Stealer/Stealer_CoreFTP.dcu

UFR_Stealer/Stealer_CoreFTP.pas

UFR_Stealer/Stealer_FAR.dcu

UFR_Stealer/Stealer_FAR.pas

UFR_Stealer/Stealer_FullTiltPoker.dcu

UFR_Stealer/Stealer_FullTiltPoker.pas

UFR_Stealer/Stealer_IncrediMail.dcu

UFR_Stealer/Stealer_IncrediMail.pas

UFR_Stealer/Stealer_MRA.dcu

UFR_Stealer/Stealer_MRA.pas

UFR_Stealer/Stealer_Opera.dcu

UFR_Stealer/Stealer_Opera.pas

UFR_Stealer/Stealer_PokerStars.dcu

UFR_Stealer/Stealer_PokerStars.pas

UFR_Stealer/Stealer_Psi.dcu

UFR_Stealer/Stealer_Psi.pas

UFR_Stealer/Stealer_SmartFTP.dcu

UFR_Stealer/Stealer_SmartFTP.pas

UFR_Stealer/Stealer_TheBat.dcu

UFR_Stealer/Stealer_TheBat.pas

UFR_Stealer/Stealer_WS_FTP.dcu

UFR_Stealer/Stealer_WS_FTP.pas

UFR_Stealer/Stealer_WTC.dcu

UFR_Stealer/Stealer_WTC.pas

UFR_Stealer/Stealer_WinSCP.dcu

UFR_Stealer/Stealer_WinSCP.pas

UFR_Stealer/Stub/1.bmp

UFR_Stealer/Stub/DELETED/recursive.asm

UFR_Stealer/Stub/DELETED/reggrab.asm

UFR_Stealer/Stub/antis.asm

UFR_Stealer/Stub/build.bat

UFR_Stealer/Stub/crc32.asm

UFR_Stealer/Stub/downloader.asm

UFR_Stealer/Stub/ftp.asm

UFR_Stealer/Stub/functions.asm

UFR_Stealer/Stub/gate.asm

UFR_Stealer/Stub/mail.asm

UFR_Stealer/Stub/noimport.asm

UFR_Stealer/Stub/readopt.asm

UFR_Stealer/Stub/rsrc.rc

UFR_Stealer/Stub/selfdelete.asm

UFR_Stealer/Stub/stealer.asm

UFR_Stealer/Stub/stealers/ChromiumBased.asm

UFR_Stealer/Stub/stealers/CoreFTP.asm

UFR_Stealer/Stub/stealers/FAR.asm

UFR_Stealer/Stub/stealers/FileZilla.asm

UFR_Stealer/Stub/stealers/FlashFXP.asm

UFR_Stealer/Stub/stealers/FullTiltPoker.asm

UFR_Stealer/Stub/stealers/GTalk.asm

UFR_Stealer/Stub/stealers/ICQ.asm

UFR_Stealer/Stub/stealers/IE.asm

UFR_Stealer/Stub/stealers/IncrediMail.asm

UFR_Stealer/Stub/stealers/Live.asm

UFR_Stealer/Stub/stealers/MagentBased.asm

UFR_Stealer/Stub/stealers/Miranda.asm

UFR_Stealer/Stub/stealers/MozillaBased.asm

UFR_Stealer/Stub/stealers/Opera.asm

UFR_Stealer/Stub/stealers/Pidgin.asm

UFR_Stealer/Stub/stealers/PokerStars.asm

UFR_Stealer/Stub/stealers/Psi.asm

UFR_Stealer/Stub/stealers/QIP2005.asm

UFR_Stealer/Stub/stealers/QIP_Infium.asm

UFR_Stealer/Stub/stealers/RAS.asm

UFR_Stealer/Stub/stealers/RDP.asm

UFR_Stealer/Stub/stealers/Safari.asm

UFR_Stealer/Stub/stealers/SmartFTP.asm

UFR_Stealer/Stub/stealers/TheBat.asm

.vbs

UFR_Stealer/Stub/stealers/WSFTP.asm

UFR_Stealer/Stub/stealers/WTC.asm

UFR_Stealer/Stub/stealers/WinSCP.asm

UFR_Stealer/Stub/stealers/__MSN.asm

UFR_Stealer/Stub/stealers/__WoT.asm

UFR_Stealer/Stub/stealers/sysinfo.asm

UFR_Stealer/Stub/stub.RES

UFR_Stealer/Stub/stub.asm

UFR_Stealer/Stub/stub.rc

UFR_Stealer/Unit3.dcu

UFR_Stealer/Unit3.dfm

UFR_Stealer/Unit3.dfm1

UFR_Stealer/Unit3.pas

.js

UFR_Stealer/VersionInfoEdit.dcu

UFR_Stealer/VersionInfoEdit.dfm

UFR_Stealer/VersionInfoEdit.pas

UFR_Stealer/Wcrypt2.dcu

UFR_Stealer/Wcrypt2.pas

UFR_Stealer/__Stealer_WoT.pas

UFR_Stealer/config.bdsproj

UFR_Stealer/config.bdsproj.local

UFR_Stealer/config.cfg

UFR_Stealer/config.dpr

UFR_Stealer/config.dproj

UFR_Stealer/config.dproj.2007

UFR_Stealer/config.dproj.local

UFR_Stealer/config.identcache

UFR_Stealer/config.res

UFR_Stealer/imgs/Cancel.bmp

UFR_Stealer/imgs/Cube.bmp

UFR_Stealer/imgs/Folder3.bmp

UFR_Stealer/imgs/Info2.bmp

UFR_Stealer/imgs/PIC_CHROMIUMBASED.ico

UFR_Stealer/imgs/PIC_COREFTP.ico

UFR_Stealer/imgs/PIC_FAR.ico

UFR_Stealer/imgs/PIC_FIREFOX.ico

UFR_Stealer/imgs/PIC_FLASHFXP.ico

UFR_Stealer/imgs/PIC_FULLTILTPOKER.ico

UFR_Stealer/imgs/PIC_FZILLA.ico

UFR_Stealer/imgs/PIC_GTALK.ico

UFR_Stealer/imgs/PIC_ICQ.ico

UFR_Stealer/imgs/PIC_IE.ico

UFR_Stealer/imgs/PIC_INCREDIMAIL.ico

UFR_Stealer/imgs/PIC_LIVE.ico

UFR_Stealer/imgs/PIC_MIRANDA.ico

UFR_Stealer/imgs/PIC_MRA.ico

UFR_Stealer/imgs/PIC_MSN.ico

UFR_Stealer/imgs/PIC_OPERA.ico

UFR_Stealer/imgs/PIC_PIDGIN.ico

UFR_Stealer/imgs/PIC_POKERSTARS.ico

UFR_Stealer/imgs/PIC_PSI.ico

UFR_Stealer/imgs/PIC_QIP2005.ico

UFR_Stealer/imgs/PIC_QIP_INFIUM.ico

UFR_Stealer/imgs/PIC_RAS.ico

UFR_Stealer/imgs/PIC_RDP.ico

UFR_Stealer/imgs/PIC_SAFARI.ico

UFR_Stealer/imgs/PIC_SEAMONKEY.ico

UFR_Stealer/imgs/PIC_SMARTFTP.ico

UFR_Stealer/imgs/PIC_SYS_DISK.ico

UFR_Stealer/imgs/PIC_SYS_FLDR.ico

UFR_Stealer/imgs/PIC_SYS_GENERAL.ico

UFR_Stealer/imgs/PIC_SYS_INFO.ico

UFR_Stealer/imgs/PIC_SYS_PROCESSES.ico

UFR_Stealer/imgs/PIC_SYS_PROGS_INSTALL.ico

UFR_Stealer/imgs/PIC_SYS_USER.ico

UFR_Stealer/imgs/PIC_THE_BAT.ico

UFR_Stealer/imgs/PIC_THUNDERBIRD.ico

UFR_Stealer/imgs/PIC_WINSCP.ico

UFR_Stealer/imgs/PIC_WOT.ico

UFR_Stealer/imgs/PIC_WS_FTP.ico

UFR_Stealer/imgs/PIC_WTC.ico

UFR_Stealer/imgs/Question.bmp

UFR_Stealer/imgs/Save.bmp

UFR_Stealer/imgs/Thumbs.db

UFR_Stealer/imgs/google_icon.png

.png

UFR_Stealer/imgs/other_anubis.ico

UFR_Stealer/imgs/other_dbg.ico

UFR_Stealer/imgs/other_filemon.ico

UFR_Stealer/imgs/other_procexp.ico

UFR_Stealer/imgs/other_procmon.ico

UFR_Stealer/imgs/other_regmon.ico

UFR_Stealer/imgs/other_sandboxie.ico

UFR_Stealer/imgs/other_vbox.ico

UFR_Stealer/imgs/other_vmware.ico

UFR_Stealer/imgs/other_wireshark.ico

UFR_Stealer/logo_temp.png

.png

UFR_Stealer/ready/v2.0.2.0/Thumbs.db

UFR_Stealer/ready/v2.0.2.0/UFR_Stealer.exe

.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_BYTES_REVERSED_LO

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 572KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

UPX1
Size: 717KB - Virtual size: 720KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

UFR_Stealer/ready/v2.0.2.0/UFR_Stealer.jpg

.jpg

UFR_Stealer/ready/v2.0.2.0/UFR_Stealer_2.jpg

.jpg

UFR_Stealer/ready/v2.0.2.0/UFR_Stealer_3.jpg

.jpg

UFR_Stealer/ready/v2.0.2.0/UFR_Stealer_712b80e1ac98cf68e92711b51bfcea34657f50fc.rar

.rar

UFR_Stealer/ready/v2.1.0.0/Thumbs.db

UFR_Stealer/ready/v2.1.0.0/UFR_Stealer.jpg

.jpg

UFR_Stealer/ready/v2.1.0.0/UFR_Stealer_2.jpg

.jpg

UFR_Stealer/ready/v2.1.0.0/UFR_Stealer_3.jpg

.jpg

UFR_Stealer/ready/v2.1.0.0/UFR_Stealer_5397b7ecbf6de27f3abbab9e52bd6a41658b75b7.rar

.rar

UFR_Stealer/ready/v2.2.0.0/Thumbs.db

UFR_Stealer/ready/v2.2.0.0/UFR_Stealer.jpg

.jpg

UFR_Stealer/ready/v2.2.0.0/UFR_Stealer_2.jpg

.jpg

UFR_Stealer/ready/v2.2.0.0/UFR_Stealer_3.jpg

.jpg

UFR_Stealer/ready/v2.2.0.0/UFR_Stealer_9d63abb94829ad629cdf1a36e5f6b89ba145efde.rar

.rar

UFR_Stealer/ready/v2.3.0.0/Thumbs.db

UFR_Stealer/ready/v2.3.0.0/UFR_Stealer.jpg

.jpg

UFR_Stealer/ready/v2.3.0.0/UFR_Stealer_0d8ce496dec63ff33bc0a810bdaabae1c5ca5aa4.rar

.rar

UFR_Stealer/ready/v2.3.0.0/UFR_Stealer_2.jpg

.jpg

UFR_Stealer/ready/v2.3.0.0/UFR_Stealer_3.jpg

.jpg

UFR_Stealer/ready/v2.3.1.0/Thumbs.db

UFR_Stealer/ready/v2.3.1.0/UFR_Stealer.jpg

.jpg

UFR_Stealer/ready/v2.3.1.0/UFR_Stealer_2.jpg

.jpg

UFR_Stealer/ready/v2.3.1.0/UFR_Stealer_3.jpg

.jpg

UFR_Stealer/ready/v2.3.1.0/UFR_Stealer_a1cba295f1810cc10a1c52a9ae75a065ab3f45b4.rar

.rar

UFR_Stealer/ready/v2.4.0.0/Thumbs.db

UFR_Stealer/ready/v2.4.0.0/UFR_Stealer.jpg

.jpg

UFR_Stealer/ready/v2.4.0.0/UFR_Stealer_2.jpg

.jpg

UFR_Stealer/ready/v2.4.0.0/UFR_Stealer_3.jpg

.jpg

UFR_Stealer/ready/v2.4.0.0/UFR_Stealer_5497bb261a4fef7c95f1968a409255f74f2f92aa.rar

.rar

UFR_Stealer/ready/v2.5.0.0/Thumbs.db

UFR_Stealer/ready/v2.5.0.0/UFR_Stealer.jpg

.jpg

UFR_Stealer/ready/v2.5.0.0/UFR_Stealer_2.jpg

.jpg

UFR_Stealer/ready/v2.5.0.0/UFR_Stealer_3.jpg

.jpg

UFR_Stealer/ready/v2.5.0.0/UFR_Stealer_4.jpg

.jpg

UFR_Stealer/ready/v2.5.0.0/UFR_Stealer_d4082075ba0beb2d5d605c9a4992979108969477.rar

.rar

UFR_Stealer/ready/v2.5.1.0/Thumbs.db

UFR_Stealer/ready/v2.5.1.0/UFR_Stealer.jpg

.jpg

UFR_Stealer/ready/v2.5.1.0/UFR_Stealer_2.jpg

.jpg

UFR_Stealer/ready/v2.5.1.0/UFR_Stealer_3.jpg

.jpg

UFR_Stealer/ready/v2.5.1.0/UFR_Stealer_4.jpg

.jpg

UFR_Stealer/ready/v2.5.1.0/UFR_Stealer_a5ba3297c851f7c85e7d940b50fedce125903aea.rar

.rar

UFR_Stealer/ready/v2.6.0.0/Thumbs.db

UFR_Stealer/ready/v2.6.0.0/UFR_Stealer.jpg

.jpg

UFR_Stealer/ready/v2.6.0.0/UFR_Stealer_2.jpg

.jpg

UFR_Stealer/ready/v2.6.0.0/UFR_Stealer_3.jpg

.jpg

UFR_Stealer/ready/v2.6.0.0/UFR_Stealer_4.jpg

.jpg

UFR_Stealer/ready/v2.6.0.0/UFR_Stealer_5bc75ffc14f19b899cbf190b2b125f4b6a0204f4.rar

.rar

UFR_Stealer/ready/v3.0.0.0/UFR1.png

.png

UFR_Stealer/ready/v3.0.0.0/UFR2.png

.png

UFR_Stealer/ready/v3.0.0.0/UFR3.png

.png

UFR_Stealer/ready/v3.0.0.0/UFR_3_0_0_0.zip

.zip

UFR_Stealer/ready/v3.0.1.0/UFR1.png

.png

UFR_Stealer/ready/v3.0.1.0/UFR2.png

.png

UFR_Stealer/ready/v3.0.1.0/UFR3.png

.png

UFR_Stealer/ready/v3.0.1.0/UFR_3_0_1_0.zip

.zip

UFR_Stealer/ready/v3.1.0.0/UFR1.png

.png

UFR_Stealer/ready/v3.1.0.0/UFR2.png

.png

UFR_Stealer/ready/v3.1.0.0/UFR3.png

.png

UFR_Stealer/ready/v3.1.0.0/UFR_3_1_0_0.zip

.zip

UFR_Stealer/ready/v3.1.1.0/UFR1.png

.png

UFR_Stealer/ready/v3.1.1.0/UFR2.png

.png

UFR_Stealer/ready/v3.1.1.0/UFR3.png

.png

UFR_Stealer/ready/v3.1.1.0/UFR_3_1_1_0.zip

.zip

UFR_Stealer/ready/v3.1.2.0/UFR1.png

.png

UFR_Stealer/ready/v3.1.2.0/UFR2.png

.png

UFR_Stealer/ready/v3.1.2.0/UFR3.png

.png

UFR_Stealer/ready/v3.1.2.0/UFR_3_1_2_0.zip

.zip

UFR_Stealer/ready/v3.1.3.0/UFR1.png

.png

UFR_Stealer/ready/v3.1.3.0/UFR2.png

.png

UFR_Stealer/ready/v3.1.3.0/UFR3.png

.png

UFR_Stealer/ready/v3.1.3.0/UFR_3_1_3_0.zip

.zip

UFR_Stealer/ready/v3.1.4.0/UFR1.png

.png

UFR_Stealer/ready/v3.1.4.0/UFR2.png

.png

UFR_Stealer/ready/v3.1.4.0/UFR3.png

.png

UFR_Stealer/ready/v3.1.4.0/UFR_3_1_4_0.zip

.zip

UFR_Stealer/ready/v3.1.5.0/UFR1.png

.png

UFR_Stealer/ready/v3.1.5.0/UFR2.png

.png

UFR_Stealer/ready/v3.1.5.0/UFR3.png

.png

UFR_Stealer/ready/v3.1.5.0/UFR_3.zip

.zip

UFR_Stealer/ready/versions.txt

UFR_Stealer/ufr.ico

UFR_Stealer/upx_bin/build.bat

UFR_Stealer/upx_bin/upx.RES

UFR_Stealer/upx_bin/upx.exe

.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

UPX1
Size: 285KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

UFR_Stealer/upx_bin/upx.rc

Sharing

General

Malware Config

Signatures

Files

Password: infected

e9d751eae4ee6793173f90f7b74d8d2d

Headers

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 384KB - Virtual size: 383KB

.data Size: 3KB - Virtual size: 3KB

.rdata Size: 40KB - Virtual size: 39KB

.bss Size: - Virtual size: 1KB

.edata Size: 6KB - Virtual size: 6KB

.idata Size: 2KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 24B

.tls Size: 512B - Virtual size: 32B

.reloc Size: 9KB - Virtual size: 9KB

/4 Size: 512B - Virtual size: 320B

/19 Size: 1024B - Virtual size: 968B

/35 Size: 2KB - Virtual size: 1KB

/51 Size: 17KB - Virtual size: 16KB

/63 Size: 3KB - Virtual size: 3KB

/77 Size: 3KB - Virtual size: 2KB

/89 Size: 1KB - Virtual size: 1KB

/102 Size: 512B - Virtual size: 269B

/113 Size: 6KB - Virtual size: 6KB

/124 Size: 512B - Virtual size: 432B

cf8e0ccf58d649ba0227a27de13bc86e

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 42KB - Virtual size: 42KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 12KB - Virtual size: 22KB

.idata Size: 1KB - Virtual size: 1KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 572KB

UPX1 Size: 717KB - Virtual size: 720KB

.rsrc Size: 21KB - Virtual size: 24KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 1.2MB

UPX1 Size: 285KB - Virtual size: 288KB

.rsrc Size: 1KB - Virtual size: 4KB

.text
Size: 384KB - Virtual size: 383KB

.data
Size: 3KB - Virtual size: 3KB

.rdata
Size: 40KB - Virtual size: 39KB

.bss
Size: - Virtual size: 1KB

.edata
Size: 6KB - Virtual size: 6KB

.idata
Size: 2KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 9KB - Virtual size: 9KB

/4
Size: 512B - Virtual size: 320B

/19
Size: 1024B - Virtual size: 968B

/35
Size: 2KB - Virtual size: 1KB

/51
Size: 17KB - Virtual size: 16KB

/63
Size: 3KB - Virtual size: 3KB

/77
Size: 3KB - Virtual size: 2KB

/89
Size: 1KB - Virtual size: 1KB

/102
Size: 512B - Virtual size: 269B

/113
Size: 6KB - Virtual size: 6KB

/124
Size: 512B - Virtual size: 432B

.text
Size: 42KB - Virtual size: 42KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 12KB - Virtual size: 22KB

.idata
Size: 1KB - Virtual size: 1KB

UPX0
Size: - Virtual size: 572KB

UPX1
Size: 717KB - Virtual size: 720KB

.rsrc
Size: 21KB - Virtual size: 24KB

UPX0
Size: - Virtual size: 1.2MB

UPX1
Size: 285KB - Virtual size: 288KB

.rsrc
Size: 1KB - Virtual size: 4KB