General

  • Target

    soan.exe

  • Size

    17.9MB

  • MD5

    635d67c69491f54b4eb2023bda710e40

  • SHA1

    ba804971c0157a44976eb6f68807cea229003219

  • SHA256

    0e74ad9b6f3e77c13cc818d7151403d85ed94d669157150ffe97d8d889c14b72

  • SHA512

    46fdac407f01d9f1f3c444a2a1a47ce7a39fe60fb56044bcedd6f593c5f63a6ba8e5212973b6118031efd9b3afe824dabf600878e773bfe711ff971e0e668223

  • SSDEEP

    393216:EqC2DlnfBfFZNRwSo67W+eGQRCMTozGxu8C0ibfz6eKk7M1bmXiWCNi:EcD1fBfFXR667W+e5RLoztZ026eKkiFi

Malware Config

Signatures

  • An infostealer written in Python and packaged with PyInstaller. 1 IoCs
  • Crealstealer family
  • Detects Pyinstaller 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • soan.exe
    .exe windows:5 windows x64 arch:x64

    1af6c885af093afc55142c2f1761dbe8


    Headers

    Imports

    Sections

  • creal.pyc