oMrongStealer.zip
- SHA256 8763547429c3c40bcbe41bb29cdb19812068ac7cd0f7cc325394e3123da7b825
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
oMrongStealer.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
oMrongStealer.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
oMrongStealer.vshost.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
oMrongStealer.vshost.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
x.dll
Resource
win7-20240705-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
x.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target oMrongStealer.zip
- Size 809KB
- Sample240715-3mk7javdkm
- SHA256 8763547429c3c40bcbe41bb29cdb19812068ac7cd0f7cc325394e3123da7b825
- MD5 9e1b939d787d91980089aa26790533e5
- SHA1 c0d67bb71d7859f66cc4efe87ba9d23b5e6147f9
- SHA512 5949167c33f554d15c31ee1ac887a5e4752428e6857a80ba0c5100f369bef46afdc950059b727e40f7c7792e07a030cad1d7c420f43ba9e57276a58366aac76c
- SSDEEP 12288:fdjfuU4wUeok/Fy6J5BSW+LlKwXY87L/yi9XiCup9Ed+J5rsSOsvdRIwFB1+qV0:fdDax2jSWIKwXY8P/ruoc3sSOsFN1+N
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/oMrongStealer.exe
File Explorer
-
oMrongStealer.zip.zip 809KB
-
oMrongStealer.exe.exe 34KB
-
oMrongStealer.exe.config186B
-
oMrongStealer.pdb39KB
-
oMrongStealer.vshost.exe.exe 22KB
-
oMrongStealer.vshost.exe.config186B
-
oMrongStealer.vshost.exe.manifest490B
-
oMrongStealer.xml684B
-
x.dll793KB
oMrongStealer.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2ddb8a9d26650aa611a29c2d25f14bceaa94f1fc083bb76f8888e72b3c479f04
- MD5 ef3fcfd290ac27112223c6ca3da63e3f
- SHA1 8f309e85d7909fc609939d84d1953d6d12f8b47b
- SHA512 b563c3591948eb5c7955f3298e1f867ef4aa2c71bc7d23b456757d01544fc15f78d77dce177df915c34a1e24f05b5de9a81624ea8221423bbac3fec21f8f9380
- SSDEEP 768:+lgugVXQVbE8dvOP9LSBIGyHF/l8Wv2b:+lgugVAVbE8dvOP1SBIGyl98WG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\ALEX\Documents\Visual Studio 2013\Projects\oMrongStealer\oMrongStealer\obj\Release\oMrongStealer.pdb
mscoree
_CorExeMain
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
oMrongStealer.exe.config
- SHA256 87451e21db5e08cdbd746570d3b2e61e9e7dddf3db87420dd751b23777f6b910
- MD5 72a9c8b79a6577721302be0a9a75f53a
- SHA1 b98675b937dabac285d37ed8dbf4d3755fb76777
- SHA512 b3bf9709bf210c431598bad84a5f8b8a53c41374e1c27e70459e0c5805a9fe480fab2e6ad6c1c4e190e7b36df1830ae68e12f8b2756c6f54c4b0977c830b0797
- MD5 SHA1 SHA512
oMrongStealer.pdb
- SHA256 542d772e093ff7e9e168d9cbe3cf2060502a1a2e88ea04f7e84ec8082055ae18
- MD5 40afee8c2f3ac5c95dfcfd212edb77e6
- SHA1 063b0ae2f3fb88d2965bf09750b53335fb307d72
- SHA512 1101f2483032a7372009eb55c79dea23929186e074d1a4e2e715e4f1e6cb52644e240d38913bb7ab610608730cf67e5d9a79efc3f58f346cf9181d0dee9e9c2a
- SSDEEP 768:KPEDklSuQfDImol2Y9/DKvuytrrkCXN4K8:KcjDImol2Y9/DKWytrrkqp8
- MD5 SHA1 SHA512 SSDEEP
oMrongStealer.vshost.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 099923b629ff4309a579a66eaa857de4e5d5caa093b6226ee7c491742d9168e9
- MD5 00c54466cfc232e2ba1dfc4f3a679f05
- SHA1 59bedfb34a5e6dc19724bab57aa72a2ddd9f76b0
- SHA512 a82bff5bd94a26fcb11d50213ff85076b3856b3f16259f8ff7ec6842b933d25e369f50c978ec9c5be589683dcdd1d5f7d5c7d093d71e737cc3f60a43f7b49416
- SSDEEP 384:JC3PZcWoWWnb/B0GftpBjPTl0qH3HRN7mF+lCY9uSX:I/U+iRB0qHuq3
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
78:11:82:87:90:19:17:fa:49:7d:b3:cb:92:39:3c:2a:48:a9:f1:0a:22:fb:06:02:2d:a1:cb:55:b0:cd:37:94
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 12, 2024
PE Signature issue
Digest
c2:44:96:a6:71:c9:c9:a2:19:cf:aa:41:bb:f5:96:90:9b:7a:7a:03
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:00:5a:ed:2f:f4:e4:20:99:3f:3a:00:00:00:00:00:5a
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 23, 2014 - Aug 23, 2015
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 22, 2014 - Jul 22, 2015
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 24, 2013 - Dec 24, 2014
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
12398
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\binaries\Intermediate\vsproject\vshost32.csproj__1853760103\objr\x86\vshost32.pdb
mscoree
_CorExeMain
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
oMrongStealer.vshost.exe.config
- SHA256 87451e21db5e08cdbd746570d3b2e61e9e7dddf3db87420dd751b23777f6b910
- MD5 72a9c8b79a6577721302be0a9a75f53a
- SHA1 b98675b937dabac285d37ed8dbf4d3755fb76777
- SHA512 b3bf9709bf210c431598bad84a5f8b8a53c41374e1c27e70459e0c5805a9fe480fab2e6ad6c1c4e190e7b36df1830ae68e12f8b2756c6f54c4b0977c830b0797
- MD5 SHA1 SHA512
oMrongStealer.vshost.exe.manifest
- SHA256 c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f
- MD5 a19a2658ba69030c6ac9d11fd7d7e3c1
- SHA1 879dcf690e5bf1941b27cf13c8bcf72f8356c650
- SHA512 fa583ba012a80d44e599285eb6a013baf41ffbe72ee8561fc89af0ec5543003ba4165bfe7b1ba79252a1b3b6e5626bf52dc712eacd107c0b093a5a2757284d73
- MD5 SHA1 SHA512
oMrongStealer.xml
- SHA256 02c352547f10a71154bcf56a30af5fc6fcd681c8653182745f37b90cadd4c766
- MD5 163d136f3f3cd18855f33693a3e0d948
- SHA1 25dd9af25cce969e785c71980f84d942df195776
- SHA512 dfe5342895c06eb1c424585c716ea8e4d468f09daf96ba51e8aa5f3c2d96dd0889195610cc83af74f1dc87f4f10ec3a79104640b2e9477036742efb9ac69b2f5
- MD5 SHA1 SHA512
x.dll
- SHA256 cf133d5d07d321b2a7f428f613aee919fd9ddd8e794f1b17af37b7d4e32adda7
- MD5 bc1f65aedb8b96ff7ac108c916652f21
- SHA1 af73b338c546ff93df99e00858129164fa8db54b
- SHA512 3199713a605c4555d388468111411eb4f925603bf8ccac3e69e7a01e1c38ee669ff594530481fb7db4c4a369154ac68214cdf1cf5877ad383bf1f527d32d9810
- SSDEEP 24576:PwD3xz7Qj+vBTnvTBKqtyKFryPf/t4Vz8nSq21VBN6OC:m3xoj+ZTnL3yKFrCfeyAB4v
- MD5 SHA1 SHA512 SSDEEP