Overview

overview

10

Static

static

10

3028-8-0x0...ry.exe

windows7-x64

10

3028-8-0x0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3028-8-0x0000000000400000-0x00000000007BD000-memory.dmp

  • Size

    3.7MB

  • MD5

    55db9ea955504ffb30493f57b236c843

  • SHA1

    15f4a5974de6cc5d78cf74f27107428df3dc4114

  • SHA256

    8c726a21643ca0e4656bc1a95762709bcf3b59a5e5318e6220ec36471fab8e5c

  • SHA512

    5747671a3f6cd48b849bbef10ba8d40f35c5f507597df9f22e4f2015c9149c42c0fe7ea0b8ce1fe1efb8b0ffbb0c993808b6b1fd02beff08981d95ee0884aaeb

  • SSDEEP

    1536:QV/6ogcasplKQJa1HmAlfR9Rwk/Tr2GreyjS0Pz+Tcgr6SzI41jfwsLkWT4MTNub:G/vgwFJ0mi2kWGreC41jBFJZu4qNUc

Score
10/10
stealc

Malware Config

Extracted

Family

stealc

C2

http://howardwood.top

Attributes
  • url_path

    /e9c345fc99a4e67e.php

rc4.plain

Signatures

  • Stealc family
    stealc
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3028-8-0x0000000000400000-0x00000000007BD000-memory.dmp
    .exe windows:5 windows x86


    Headers

    Sections