Analysis
-
max time kernel
94s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2024 21:43
Static task
static1
Behavioral task
behavioral1
Sample
520d7fbf7412bc830e5c8bd993226be5e332dc1bdf414623cc7f5887588f010d.dll
Resource
win7-20240221-en
General
-
Target
520d7fbf7412bc830e5c8bd993226be5e332dc1bdf414623cc7f5887588f010d.dll
-
Size
211KB
-
MD5
6b70f57fc62db710dfaaa527a58f723a
-
SHA1
9627adba486339ef47c5a3a4acf85ee486c7acb2
-
SHA256
520d7fbf7412bc830e5c8bd993226be5e332dc1bdf414623cc7f5887588f010d
-
SHA512
ca916a3240fd3e2d98df9eed6f41fb69f8dd4fc1a539abdcaee4472cfb3577782d5ca0370e366df0954ae9f0d327e1b2ed3b8cf235514d0234dd9a4d0280b1c4
-
SSDEEP
3072:OaHO5UfOrQIsuWIh/oaKRySFgCqWJMmz+wUex7mvBRjH9uNi1owmKzNweXITUB:O5U2Enaoa2gSt+2YNuWzpKUB
Malware Config
Extracted
strela
45.9.74.12
-
url_path
/server.php
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Signatures
-
Detects Strela Stealer payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1112-1-0x0000000002D30000-0x0000000002D52000-memory.dmp family_strela behavioral2/memory/1112-0-0x00007FF863E20000-0x00007FF863E5C000-memory.dmp family_strela