Behavioral task
behavioral1
Sample
Steamy_p.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Steamy_p.exe
Resource
win10v2004-20240508-en
General
-
Target
Steamy_p.exe
-
Size
2.1MB
-
MD5
7cc67fe5715d822d9c2ad6c0a7f77c22
-
SHA1
2cc452d8d3809f5e3b8ceb82ed4bee1807201dac
-
SHA256
a0c0dc5f81e4dc7a56e01d25ff52905a943a7d52c4e68578b1ad28ac3f84e07a
-
SHA512
3cf02fb91ef3fdad157746ad1b559e054a2bec23a9fd88c77c5fd905974d0063a59d404bffae93204445bd9069fea47e5fb156af13b22b480694c46eb17cea37
-
SSDEEP
24576:VXs9PbMqM0Ub8m657w6ZBLmkitKqBCjC0PDgM5AZFkm8CQ5HIxtxayKyKZRQ6Ijv:mbGVV1BCjByJQ5HGtJYZRJI
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Steamy_p.exe
Files
-
Steamy_p.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 237KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX0 Size: 1.1MB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 624KB - Virtual size: 624KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE