windealer | 1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128 | Triage

Submit
Reports

Overview

overview

Static

static

3

1e9fc7f32b...28.exe

windows7-x64

1e9fc7f32b...28.exe

windows10-2004-x64

Sharing

General

Target

1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128
Size

352KB
Sample

240410-lxqrbsbd62
MD5

5a7a90ceb6e7137c753d8de226fc7947
SHA1

204a603c409e559b65c35208200a169a232da94c
SHA256

1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128
SHA512

a1f8dcf279b0f0b74d4e7890f118bbf27d0c20da75ebb670c0ee41dae6e16eae86c05fea5a6b51756b93360b8965545c3bde76b2beefeebed44a19fa42af79ed
SSDEEP

6144:YZZC6Tf4RnqqfjkKlirFW1jGVr9nOhKy0zIBd6CiBP0PfL+eDHSVJs0z9LjS7g:ONTwxIKlirM1jAy0MjPi2Pj+oA/2

Score

10^/10

windealer stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128.exe

Resource

win7-20240221-en

windealer stealer trojan

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128.exe

Resource

win10v2004-20240226-en

windealer stealer trojan

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Targets

- Target
  
  1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128
- Size
  
  352KB
- MD5
  
  5a7a90ceb6e7137c753d8de226fc7947
- SHA1
  
  204a603c409e559b65c35208200a169a232da94c
- SHA256
  
  1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128
- SHA512
  
  a1f8dcf279b0f0b74d4e7890f118bbf27d0c20da75ebb670c0ee41dae6e16eae86c05fea5a6b51756b93360b8965545c3bde76b2beefeebed44a19fa42af79ed
- SSDEEP
  
  6144:YZZC6Tf4RnqqfjkKlirFW1jGVr9nOhKy0zIBd6CiBP0PfL+eDHSVJs0z9LjS7g:ONTwxIKlirM1jAy0MjPi2Pj+oA/2
Score

10^/10

windealer stealer trojan
- Detect WinDealer information stealer
  stealer
- WinDealer
  WinDealer is an info stealer used by LuoYu group.
  stealer trojan windealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

windealerstealertrojan

behavioral2

windealerstealertrojan

© 2018-2024

Terms | Privacy