C:\Users\notfishvr\Downloads\GodStealer-main\GodStealer-main\GodStealer\obj\Debug\Sahyui1337.pdb
Behavioral task
behavioral1
Sample
Sahyui1337.exe
Resource
win7-20240220-en
General
-
Target
Sahyui1337.exe
-
Size
316KB
-
MD5
2693065c7466d53bc86bc26ab8d657ea
-
SHA1
8ec18593214537e019cedc37267156871c57cd2c
-
SHA256
3a506705c6e005e1a74b9449af0e7474b3a8602442e84cd6ece7f1fbc99a3929
-
SHA512
f470bfe4cdca82de7d453d4dbeaed8de46cf1e82a9c1a9fbd7d4180158500f97311ca631e4a6c43416d999a6c9a12487c8b31a46956a1e360a8f265c173f6401
-
SSDEEP
6144:0syU6MDdbBCydeWh53MCL7LLVmBivzU7nx5VZ2Fvd:0spP3MCL7LTG5V0vd
Malware Config
Extracted
growtopia
https://discord.com/api/webhooks/1213276088067956746/zJW67eYDWSXdbZ0gcW2u1ph9Sy4d5Gty57RjKvf-OGTMj-ubZMU_ZFvxQE_Yec_aCK5b
Signatures
-
Growtopia family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Sahyui1337.exe
Files
-
Sahyui1337.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 311KB - Virtual size: 310KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ