Overview

overview

10

Static

static

10

4812-1-0x0...ry.exe

windows7-x64

10

4812-1-0x0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4812-1-0x0000000000400000-0x000000000063C000-memory.dmp

  • Size

    2.2MB

  • MD5

    a0cccc8bdec5088eadf45d75fcec804e

  • SHA1

    ebae0393d30077c3aa9b25d7acf62e197d39bdb9

  • SHA256

    7e5d42f7984bf0136b59fc7a250aeaa8d30daa0d2135376258321824da6ceb7a

  • SHA512

    6349cd41cd4919a1d2f741313568f0153fe251cc5885f6f1c7f3de2e5592bfde551d1c88b6ef80700cc7e8c8cfb82e14d2d4af452df99335a631ca2a5486ba1e

  • SSDEEP

    3072:fTzpScId/0vFsLz43PNKMQgC6OFrAZQXMHrxG5RaBpW:f/DId/0tflJ7OF0U6QRa

Score
10/10
defaultstealc

Malware Config

Extracted

Family

stealc

Botnet

default

C2

http://94.228.166.55

Attributes
  • url_path

    /924cf5c06b0c4fee.php

Signatures

  • Stealc family
    stealc
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4812-1-0x0000000000400000-0x000000000063C000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections