cab5e397fae55321db19a67f5cda2111944f71b5e5239d6a3dfa8ad8932e79ac

Sharing

Copy URL Twitter E-mail

General

Target

cab5e397fae55321db19a67f5cda2111944f71b5e5239d6a3dfa8ad8932e79ac
Size

4.8MB
MD5

d2de19183de45d530c2849bf50569e87
SHA1

35103892cb5750304adb03df6a96a5b0f7b79ff8
SHA256

cab5e397fae55321db19a67f5cda2111944f71b5e5239d6a3dfa8ad8932e79ac
SHA512

8a364f60727d364787c7d7cfd936b4de7aa61bfc2ad921ace3f5926aabd6ec0a8db3ac0fa659d41a62aec45d971d3f33a9a0a5c13f47f2985895ed78a787a147
SSDEEP

49152:7eO2ibD1JdgZDCVzvSxDJuAiwQuaF4p/mE7UjsWqyEL9s9iIsVix3PYE7QULIvHh:7ZRguEaaLwvCoAULIvxCVYWK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cab5e397fae55321db19a67f5cda2111944f71b5e5239d6a3dfa8ad8932e79ac

Files

cab5e397fae55321db19a67f5cda2111944f71b5e5239d6a3dfa8ad8932e79ac
.exe windows:6 windows x64 arch:x64

15b5c90344f1709e227575b8c75729e7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\dotnetcore\stealer_bot\bin\Release\net9.0\win-x64\native\test_.pdb

Imports

advapi32

AdjustTokenPrivileges
DeregisterEventSource
GetTokenInformation
ImpersonateLoggedOnUser
LookupPrivilegeValueW
OpenProcessToken
OpenThreadToken
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegisterEventSourceW
ReportEventW
RevertToSelf

bcrypt

BCryptGetProperty
BCryptGenRandom
BCryptExportKey
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptImportKeyPair
BCryptOpenAlgorithmProvider

crypt32

CryptImportPublicKeyInfoEx2
CryptFormatObject
CryptFindOIDInfo
CryptDecodeObject
CertVerifyTimeValidity
CertVerifyCertificateChainPolicy
CertOpenStore
CertNameToStrW
CertAddCertificateContextToStore
CertAddCertificateLinkToStore
CertCloseStore
CertControlStore
CertCreateCertificateChainEngine
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetIntendedKeyUsage
CertGetNameStringW
CertGetValidUsages

iphlpapi

if_nametoindex

kernel32

TlsAlloc
RaiseException
TlsSetValue
TlsFree
RtlPcToFileHeader
TlsGetValue
InitializeCriticalSectionAndSpinCount
CancelIoEx
CancelSynchronousIo
CancelThreadpoolIo
CheckRemoteDebuggerPresent
CloseHandle
CloseThreadpoolIo
CloseThreadpoolWait
CloseThreadpoolWork
CopyFileExW
CreateDirectoryW
CreateEventExW
CreateFileW
CreateIoCompletionPort
CreateMutexExW
CreatePipe
CreateProcessW
CreateThread
CreateThreadpoolIo
CreateThreadpoolTimer
CreateThreadpoolWait
CreateThreadpoolWork
DeleteCriticalSection
DeleteFileW
DeleteVolumeMountPointW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FormatMessageW
FreeLibrary
GetCPInfo
GetCPInfoExW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumberEx
GetCurrentThread
GetCurrentThreadId
GetDriveTypeW
GetDynamicTimeZoneInformation
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileType
GetFullPathNameW
GetLastError
GetLogicalDrives
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetOverlappedResult
GetProcAddress
GetProcessId
GetStdHandle
GetSystemDirectoryW
GetSystemTime
GetThreadPriority
GetTickCount64
GetTimeZoneInformation
InitializeConditionVariable
InitializeCriticalSection
IsDebuggerPresent
IsWow64Process
K32EnumProcessModulesEx
K32EnumProcesses
K32GetModuleBaseNameW
K32GetModuleFileNameExW
K32GetModuleInformation
LeaveCriticalSection
LoadLibraryExW
LocalAlloc
LocalFree
LockFile
LockFileEx
MultiByteToWideChar
OpenProcess
OpenThread
QueryFullProcessImageNameW
QueryPerformanceCounter
QueryPerformanceFrequency
QueryUnbiasedInterruptTime
RaiseFailFastException
ReadConsoleW
ReadFile
RemoveDirectoryW
ResetEvent
ResumeThread
SetCurrentDirectoryW
SetEvent
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetLastError
SetThreadErrorMode
SetThreadPriority
SetThreadpoolTimer
SetThreadpoolWait
Sleep
SleepConditionVariableCS
StartThreadpoolIo
SubmitThreadpoolWork
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
UnlockFile
VirtualAlloc
VirtualFree
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForThreadpoolWaitCallbacks
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
FlushProcessWriteBuffers
WaitForSingleObjectEx
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
VerSetConditionMask
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
QueryInformationJobObject
GetModuleHandleW
GetModuleHandleExW
GetProcessAffinityMask
VerifyVersionInfoW
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
VirtualQuery
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
DebugBreak
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
EncodePointer
DecodePointer
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
GetProcessHeap
RtlUnwindEx
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry

ncrypt

NCryptOpenKey
NCryptGetProperty
NCryptFreeObject
NCryptDeleteKey
NCryptOpenStorageProvider
NCryptImportKey
NCryptSetProperty

ole32

CoWaitForMultipleHandles
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoInitializeEx
CoGetApartmentType

secur32

GetUserNameExW

ws2_32

shutdown
ioctlsocket
setsockopt
recv
select
WSASend
FreeAddrInfoExW
FreeAddrInfoW
GetAddrInfoExW
GetAddrInfoW
GetNameInfoW
WSACleanup
WSAConnect
WSAGetOverlappedResult
WSAIoctl
WSARecv
getsockopt
WSASocketW
WSAStartup
bind
closesocket
gethostname
send

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
calloc
free
malloc

api-ms-win-crt-math-l1-1-0

modf
ceil
floor
__setusermatherr

api-ms-win-crt-string-l1-1-0

_stricmp
strcmp
wcsncmp
strcpy_s

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_initterm_e
_initterm
_register_onexit_function
_initialize_onexit_table
_get_initial_wide_environment
terminate
_initialize_wide_environment
abort
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___wargv
__p___argc
_configure_wide_argv
_exit
_seh_filter_exe
_set_app_type
exit

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

hydrated
Size: - Virtual size: 918KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 194KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15b5c90344f1709e227575b8c75729e7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

bcrypt

crypt32

iphlpapi

kernel32

ncrypt

ole32

secur32

ws2_32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

hydrated Size: - Virtual size: 918KB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 15KB - Virtual size: 97KB

.pdata Size: 194KB - Virtual size: 194KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 3.1MB - Virtual size: 3.1MB

hydrated
Size: - Virtual size: 918KB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 15KB - Virtual size: 97KB

.pdata
Size: 194KB - Virtual size: 194KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB