unicornstealer | 6e667db54814bbf9cde7c00a1f9ccaad_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

6e667db54814bbf9cde7c00a1f9ccaad_JaffaCakes118
Size

1.2MB
MD5

6e667db54814bbf9cde7c00a1f9ccaad
SHA1

a2feadc2e292c60436f63cdc17a7a61ed78b9859
SHA256

eb20f12dd433c5c9174bc138d1c44266cc3a36f59fae9ddae8c0f246943c8801
SHA512

c77f5395a188feae436ac88d675d215d220bbd0fdd659522d99140c5add8edfa17f8447ce8f56f17ff22f51a2aac21ca393c01b8c46093c1c5080f9f4f3427ba
SSDEEP

24576:yzd9Sm6s3SB4VbhzGcHb0bBhXxtyesOlU0YOTAXnA91IV7HExDaIS:yzTSmvdcwb0VhXHlrTKA91IV7HExOIS

Score

10^/10

stealer unicornstealer

Malware Config

Signatures

Unicorn Stealer payload 1 IoCs

stealer

resource	yara_rule
sample	unicorn

Unicornstealer family
unicornstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6e667db54814bbf9cde7c00a1f9ccaad_JaffaCakes118

Files

6e667db54814bbf9cde7c00a1f9ccaad_JaffaCakes118
.exe windows:6 windows x86 arch:x86

bdf1cab1845d3b5344585c5428062993

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
ExpandEnvironmentStringsW
TerminateProcess
SetFileTime
LeaveCriticalSection
UnmapViewOfFile
OpenProcess
CreateToolhelp32Snapshot
Sleep
Process32NextW
FlushViewOfFile
Process32FirstW
CreateThread
SetFilePointerEx
GetFileSize
SystemTimeToFileTime
GetSystemTime
CreateFileMappingW
MapViewOfFile
LocalAlloc
InitializeCriticalSection
SetEndOfFile
lstrcpyA
GetModuleHandleA
GetLastError
GlobalLock
GlobalUnlock
lstrcmpiA
K32GetModuleFileNameExW
WideCharToMultiByte
GetVolumeInformationA
lstrcatA
GetTempPathA
GetUserDefaultLCID
lstrcatW
GetProcAddress
TerminateThread
EnterCriticalSection
SetNamedPipeHandleState
WaitNamedPipeA
CreateNamedPipeA
WriteFileEx
DisconnectNamedPipe
CreateEventW
CreateFileA
SetEvent
WaitForSingleObjectEx
ReadFileEx
GetOverlappedResult
lstrcpynA
ConnectNamedPipe
ReadProcessMemory
ExitThread
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
LocalFree
ExitProcess
GetCurrentDirectoryW
SetCurrentDirectoryW
MultiByteToWideChar
GetFileAttributesExW
FindFirstFileExW
GetCommandLineW
GetCommandLineA
ReadFile
lstrcmpA
lstrlenA
lstrcmpW
lstrcmpiW
lstrcpyW
FindClose
VirtualAlloc
lstrlenW
FindNextFileW
FindFirstFileW
MoveFileW
QueryPerformanceCounter
GetTempFileNameW
CopyFileW
CreateProcessW
RtlUnwind
FormatMessageA
MoveFileExA
VerifyVersionInfoA
GetSystemDirectoryA
QueryPerformanceFrequency
VerSetConditionMask
SleepEx
GetTickCount
CloseHandle
GlobalFree
DeleteFileW
GlobalAlloc
GetSystemDirectoryW
CreateFileW
WaitForSingleObject
GetTempPathW
WriteFile
CreateEventA
WaitForMultipleObjects
LoadLibraryA
GetEnvironmentVariableA
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetLocalTime
InitializeSListHead
GetCurrentProcessId
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSize
WriteConsoleW
GetModuleFileNameW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetProcessHeap
GetFileSizeEx
GetFullPathNameW
GetTimeZoneInformation
FlushFileBuffers
GetModuleHandleExW
VirtualQuery
GetModuleHandleW
RaiseException
DecodePointer
DeleteCriticalSection
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
GetFileType
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
HeapAlloc
HeapFree
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryExW
CompareStringW
LCMapStringW
GetStdHandle
GetStartupInfoW
SetLastError
GetCurrentThreadId
HeapReAlloc
SetStdHandle
GetConsoleCP
GetConsoleMode
ReadConsoleW
EncodePointer

user32

GetMessageW
DefWindowProcW
TranslateMessage
CloseClipboard
wsprintfW
wsprintfA
CreateWindowExA
OpenClipboard
SendMessageA
GetClipboardData
EmptyClipboard
SetTimer
GetWindowTextW
ToUnicode
SetWindowsHookExW
GetForegroundWindow
CallNextHookEx
GetKeyState
GetCursorPos
SetClipboardData
DispatchMessageW
RegisterClassExA
SetClipboardViewer
ReleaseDC
GetWindowThreadProcessId
SetProcessDPIAware
GetWindowRect
GetDC

gdi32

GetStockObject
GetCurrentObject
DeleteObject
GetObjectW
DeleteDC
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt

shell32

CommandLineToArgvW

secur32

GetUserNameExW
InitSecurityInterfaceA

winhttp

WinHttpQueryDataAvailable
WinHttpConnect
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpOpen
WinHttpReceiveResponse

msvcrt

memset
memmove
vsprintf_s
_vscprintf
vprintf
memcmp
memchr
strstr
memcpy

shlwapi

StrChrW
StrStrIW
PathFileExistsW

gdiplus

GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipSaveImageToFile
GdipGetImageEncoders
GdiplusStartup
GdipCloneImage

advapi32

CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptDestroyKey
CryptExportKey
CryptEncrypt
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptImportKey
CryptGetHashParam

bcrypt

BCryptDuplicateHash
BCryptImportKeyPair
BCryptImportKey
BCryptEncrypt
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptFinishHash
BCryptGenRandom
BCryptDestroyKey

ws2_32

gethostname
ioctlsocket
select
__WSAFDIsSet
WSAIoctl
WSASetLastError
setsockopt
ntohs
getsockopt
getsockname
getpeername
bind
WSAGetLastError
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSACleanup
inet_ntoa
inet_addr
htons
recv
connect
socket
send
WSAStartup
gethostbyname
closesocket

crypt32

CryptStringToBinaryA
CryptBinaryToStringA
CryptDecodeObject

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_multi_wakeup
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup
curl_url_dup
curl_url_get
curl_url_set

Sections

.text
Size: 672KB - Virtual size: 672KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 404KB - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bdf1cab1845d3b5344585c5428062993

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

secur32

winhttp

msvcrt

shlwapi

gdiplus

advapi32

bcrypt

ws2_32

crypt32

Exports

Exports

Sections

.text Size: 672KB - Virtual size: 672KB

.rdata Size: 108KB - Virtual size: 108KB

.data Size: 404KB - Virtual size: 404KB

.reloc Size: 24KB - Virtual size: 24KB

.text
Size: 672KB - Virtual size: 672KB

.rdata
Size: 108KB - Virtual size: 108KB

.data
Size: 404KB - Virtual size: 404KB

.reloc
Size: 24KB - Virtual size: 24KB