c:\users\kingdom\documents\visual studio 2013\Projects\AbBuilder\AbBuilder\obj\Debug\AbBuilder.pdb
Overview
overview
7Static
static
3AbStealer Builder.7z
windows7-x64
3AbStealer Builder.7z
windows10-2004-x64
7Ab-Stealer....0.exe
windows7-x64
1Ab-Stealer....0.exe
windows10-2004-x64
1Ab-Stealer...il.dll
windows7-x64
1Ab-Stealer...il.dll
windows10-2004-x64
1Ab-Stealer...ST.php
windows7-x64
3Ab-Stealer...ST.php
windows10-2004-x64
3Ab-Stealer...el.php
windows7-x64
3Ab-Stealer...el.php
windows10-2004-x64
3Ab-Stealer....0.rar
windows7-x64
3Ab-Stealer....0.rar
windows10-2004-x64
7AbBuild v.1.0.exe
windows7-x64
1AbBuild v.1.0.exe
windows10-2004-x64
1Mono.Cecil.dll
windows7-x64
1Mono.Cecil.dll
windows10-2004-x64
1Ab-Stealer....0.exe
windows7-x64
1Ab-Stealer....0.exe
windows10-2004-x64
1Ab-Stealer...il.dll
windows7-x64
1Ab-Stealer...il.dll
windows10-2004-x64
1Ab-Stealer...go.png
windows7-x64
3Ab-Stealer...go.png
windows10-2004-x64
3Ab-Stealer...bg.jpg
windows7-x64
3Ab-Stealer...bg.jpg
windows10-2004-x64
3Ab-Stealer...ex.php
windows7-x64
3Ab-Stealer...ex.php
windows10-2004-x64
3Ab-Stealer...fo.php
windows7-x64
3Ab-Stealer...fo.php
windows10-2004-x64
3Ab-Stealer...in.php
windows7-x64
3Ab-Stealer...in.php
windows10-2004-x64
3Ab-Stealer...ut.php
windows7-x64
3Ab-Stealer...ut.php
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
AbStealer Builder.7z
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
AbStealer Builder.7z
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Ab-Stealer-main/AbBuild v.1.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Ab-Stealer-main/AbBuild v.1.0.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Ab-Stealer-main/Mono.Cecil.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Ab-Stealer-main/Mono.Cecil.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Ab-Stealer-main/Panel/POST.php
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Ab-Stealer-main/Panel/POST.php
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Ab-Stealer-main/Panel/Panel.php
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Ab-Stealer-main/Panel/Panel.php
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Ab-Stealer-main/Panel/img/AbBuild v.1.0.rar
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Ab-Stealer-main/Panel/img/AbBuild v.1.0.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
AbBuild v.1.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
AbBuild v.1.0.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Mono.Cecil.dll
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
Mono.Cecil.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Ab-Stealer-main/Panel/img/AbBuild v.1.0/AbBuild v.1.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Ab-Stealer-main/Panel/img/AbBuild v.1.0/AbBuild v.1.0.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
Ab-Stealer-main/Panel/img/AbBuild v.1.0/Mono.Cecil.dll
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
Ab-Stealer-main/Panel/img/AbBuild v.1.0/Mono.Cecil.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Ab-Stealer-main/Panel/img/Logo.png
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Ab-Stealer-main/Panel/img/Logo.png
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
Ab-Stealer-main/Panel/img/bg.jpg
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Ab-Stealer-main/Panel/img/bg.jpg
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Ab-Stealer-main/Panel/index.php
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Ab-Stealer-main/Panel/index.php
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Ab-Stealer-main/Panel/info.php
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Ab-Stealer-main/Panel/info.php
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
Ab-Stealer-main/Panel/login.php
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
Ab-Stealer-main/Panel/login.php
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Ab-Stealer-main/Panel/logout.php
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
Ab-Stealer-main/Panel/logout.php
Resource
win10v2004-20240226-en
General
-
Target
AbStealer Builder.7z
-
Size
275KB
-
MD5
edd911eb6f5a540b93a1fbc3fa5972bd
-
SHA1
722802ebb60acf876d723e10423a432bc1a2d216
-
SHA256
b9d5b9e6591f359bac9f4983a4feeb555d3d59f94ba22f6fa5874424ef6a4790
-
SHA512
d61137ac50806a8925f043d196b2e750b07d7bec59f4871b860731cfe4f24dc1a1aa39347711581a32937f481be81f7ab3768f876f6d488ea449e390d1d35b98
-
SSDEEP
6144:xj1VayCFXrSfmE80Hijcr9iO+MegBKEDtuaptPj7bg9GI/mSADd9i:xXayCFS80HiIr9iGDtuavPDcmSAB9i
Malware Config
Signatures
-
Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/Ab-Stealer-main/AbBuild v.1.0.exe unpack001/Ab-Stealer-main/Mono.Cecil.dll unpack004/AbBuild v.1.0.exe unpack004/Mono.Cecil.dll unpack001/Ab-Stealer-main/Panel/img/AbBuild v.1.0/AbBuild v.1.0.exe unpack001/Ab-Stealer-main/Panel/img/AbBuild v.1.0/Mono.Cecil.dll
Files
-
AbStealer Builder.7z.7z
Password: infected
-
Ab-Stealer-main/AbBuild v.1.0.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Ab-Stealer-main/Mono.Cecil.dll.dll windows:4 windows x86 arch:x86
Password: infected
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
C:\Users\njq8\Desktop\jbevain-cecil-0.9.5-73-ga5ffcc0\jbevain-cecil-a5ffcc0\obj\net_2_0_Debug\Mono.Cecil.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 303KB - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Ab-Stealer-main/Panel/POST.php
-
Ab-Stealer-main/Panel/Panel.php
-
Ab-Stealer-main/Panel/img/AbBuild v.1.0.rar.rar
Password: infected
-
AbBuild v.1.0.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
c:\users\kingdom\documents\visual studio 2013\Projects\AbBuilder\AbBuilder\obj\Debug\AbBuilder.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Mono.Cecil.dll.dll windows:4 windows x86 arch:x86
Password: infected
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
C:\Users\njq8\Desktop\jbevain-cecil-0.9.5-73-ga5ffcc0\jbevain-cecil-a5ffcc0\obj\net_2_0_Debug\Mono.Cecil.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 303KB - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Ab-Stealer-main/Panel/img/AbBuild v.1.0/AbBuild v.1.0.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
c:\users\kingdom\documents\visual studio 2013\Projects\AbBuilder\AbBuilder\obj\Debug\AbBuilder.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Ab-Stealer-main/Panel/img/AbBuild v.1.0/Mono.Cecil.dll.dll windows:4 windows x86 arch:x86
Password: infected
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
C:\Users\njq8\Desktop\jbevain-cecil-0.9.5-73-ga5ffcc0\jbevain-cecil-a5ffcc0\obj\net_2_0_Debug\Mono.Cecil.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 303KB - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Ab-Stealer-main/Panel/img/Logo.png.png
Password: infected
-
Ab-Stealer-main/Panel/img/bg.jpg.jpg
-
Ab-Stealer-main/Panel/index.php
-
Ab-Stealer-main/Panel/info.php
-
Ab-Stealer-main/Panel/login.php
-
Ab-Stealer-main/Panel/logout.php
-
Ab-Stealer-main/Panel/ps.php
-
Ab-Stealer-main/Panel/style.css
-
Ab-Stealer-main/README.md