Behavioral task
behavioral1
Sample
4988-7-0x0000000000400000-0x000000000089E000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4988-7-0x0000000000400000-0x000000000089E000-memory.exe
Resource
win10v2004-20240426-en
General
-
Target
4988-7-0x0000000000400000-0x000000000089E000-memory.dmp
-
Size
4.6MB
-
MD5
e8437864b54acb8e17840bf61270b4f7
-
SHA1
debe61afd4402bba88b96918f672362b2a86a94c
-
SHA256
5379186657028e1bcd7e0be1507e0ef14109d7973dfe80e016cf47192d910912
-
SHA512
811b5eeb06ec551aa0d3dfb4eb7f1a72e088a8b2af10a9f7ddded30cb0fd1b97ecf9a089e99860ef4c0a7ed6eed2e42d788f5a6be1ff59c61b0dc164faead61c
-
SSDEEP
49152:2g/0pQi1b4bSbHByQWa35nOvI2+t+RmJRt/xdtjRRB:2g/0d1UbX/Iwmd
Malware Config
Extracted
stealc
Extracted
vidar
https://steamcommunity.com/profiles/76561199689717899
https://t.me/copterwin
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Signatures
Files
-
4988-7-0x0000000000400000-0x000000000089E000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text0 Size: - Virtual size: 657KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 1024B - Virtual size: 808B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text2 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ