marsstealer | 3008-39-0x0000000000400000-0x000000000043D000-memory[.]dmp

General

Target
3008-39-0x0000000000400000-0x000000000043D000-memory.dmp
Size 244KB
Sample231122-rpayssda67
SHA256 dec5d84503df5a8f3d55c38f234be864d75ac8f73a5803c40db88ab487b962b6
MD5 1a119c4c0e29e8392fe073ec1e392132
SHA1 7aab3c5fdab131cd9a1942196549da478cdbe725
SHA512 4ed5200bef0e2cee182632b900322b81ff250965c8f2426f9ac3cbaf9559c82b6a2cb5d9808ff7021cd3a019f2ebd96c28339545a6e241b406e8ef79ed5f9587
SSDEEP 3072:Um/E8k9ZjpIL+zNch12KbAwSaShJSp8Ob8EG:N/E8k91zz6/tN8EG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3008-39-0x0000000000400000-0x000000000043D000-memory.dmp

SHA256 dec5d84503df5a8f3d55c38f234be864d75ac8f73a5803c40db88ab487b962b6
MD5 1a119c4c0e29e8392fe073ec1e392132
SHA1 7aab3c5fdab131cd9a1942196549da478cdbe725
SHA512 4ed5200bef0e2cee182632b900322b81ff250965c8f2426f9ac3cbaf9559c82b6a2cb5d9808ff7021cd3a019f2ebd96c28339545a6e241b406e8ef79ed5f9587
SSDEEP 3072:Um/E8k9ZjpIL+zNch12KbAwSaShJSp8Ob8EG:N/E8k91zz6/tN8EG
MD5 SHA1 SHA512 SSDEEP

Minor OS version

1

Major OS version

5

Entry point

245938

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths