Behavioral task
behavioral1
Sample
1136-283-0x0000000000260000-0x0000000000913000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1136-283-0x0000000000260000-0x0000000000913000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
1136-283-0x0000000000260000-0x0000000000913000-memory.dmp
-
Size
6.7MB
-
MD5
a16d1afea82fd4786932fc80a9bcf4b9
-
SHA1
c7ff14e1d2508967c6531fa45d425565641c88bd
-
SHA256
e79d9be9949692728cce1ae89b8b6542b04891214ad76f52e855ce33c68f3d47
-
SHA512
8d64f5978b2881d60d73f44d10e5f0abe64429638f35be56f08c22a24982f114031e735a33085cc55023136e84bb1d8de72ed422e73e8e093c5242939cee2db6
-
SSDEEP
6144:tYJJ2cBPQbp6ZHGBnqmTysu0oHIWUNoyy/1:GRBPJZHGBnqmTysu0oHIWUNoyy/1
Malware Config
Extracted
icarusstealer
-
payload_url
https://raw.githubusercontent.com/HiddenEyeZ/tg/main/rt.jpg
Signatures
-
Icarusstealer family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1136-283-0x0000000000260000-0x0000000000913000-memory.dmp
Files
-
1136-283-0x0000000000260000-0x0000000000913000-memory.dmp.exe .js windows:4 windows x86 arch:x86 polyglot
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 395KB - Virtual size: 394KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ