Overview

overview

10

Static

static

10

1472-0-0x0...ry.dll

windows7-x64

1

1472-0-0x0...ry.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    1472-0-0x000007FEFAA30000-0x000007FEFAA60000-memory.dmp

  • Size

    192KB

  • MD5

    bbdee24a3743015f128b9aff285543d5

  • SHA1

    8281db2fa088126bd465ae58038ddbb4dd399e44

  • SHA256

    ca137de08f6c7cd6127b0538d28ec5e6c5308212019de9f993df1a17b61e299d

  • SHA512

    34c6357b0697b2ef8849a6b9452ba1e82944d101d4ae36b324066562f9650eaa9220f20e26457b8f7bc0c9402f7747d190ee238d2c8f67f9001fe71c3ac58404

  • SSDEEP

    3072:gh5nm41meB57QrRdArDw3RRQ0DnnmvxC2cFUex9D4Qnqds:e5NxmrRdArDw30Snnmv0JUeoQnq

Score
10/10
strela

Malware Config

Extracted

Family

strela

C2

45.9.74.13

Attributes
  • url_path

    /server.php

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537

Signatures

  • Detects Strela Stealer payload 1 IoCs
  • Strela family
    strela
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1472-0-0x000007FEFAA30000-0x000007FEFAA60000-memory.dmp
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections