deerstealer | 3297556040f2565083294ea907bf6904ef7074b3f37695e4661b2c6dc3b047c1[.]bin[.]zip

Resubmissions

23/08/2024, 09:01

240823-kyzj7axfmm10

28/07/2024, 15:31

240728-sydaysvcre10

Sharing

Copy URL Twitter E-mail

General

Target
3297556040f2565083294ea907bf6904ef7074b3f37695e4661b2c6dc3b047c1.bin.zip
Size 1.5MB
Sample240728-sydaysvcre
SHA256 845be16eafbddc4673662fb780fdd1adae2e250cfe9e0117164fd12d3ca5930e
MD5 30c51150d96172a34d0991bf782a1888
SHA1 47195cbe19f329c99bbc7e123e54f746dcbd0468
SHA512 3eeba111cd36ef68783556dd96a92249d9e225d148797fe946bc66b8cd7af4bdb3d32b9896ec96d68ed30f7938c6a663ce726fa2645d1e9207d5d76eb4cf69e2
SSDEEP 24576:FXioCDKoQAhALqaI6BsTZeWj1TH8/APFpB65WaBGKR48yf3qQenkqnxiyVWYIXKX:AoHdYaIPTZes18/AV2Wai88qQenTnf8Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealer deerstealer

Malware Config

Signatures

DeerStealer 1 IoCs

Detects DeerStealer malware - JaffaCakes118.

stealer

resource	yara_rule
static1/unpack001/3297556040f2565083294ea907bf6904ef7074b3f37695e4661b2c6dc3b047c1.bin	DeerStealer

Deerstealer family
deerstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3297556040f2565083294ea907bf6904ef7074b3f37695e4661b2c6dc3b047c1.bin

File Explorer

3297556040f2565083294ea907bf6904ef7074b3f37695e4661b2c6dc3b047c1.bin.zip

.zip 1.5MB
3297556040f2565083294ea907bf6904ef7074b3f37695e4661b2c6dc3b047c1.bin

.exe 2.6MB

3297556040f2565083294ea907bf6904ef7074b3f37695e4661b2c6dc3b047c1.bin.zip

SHA256 845be16eafbddc4673662fb780fdd1adae2e250cfe9e0117164fd12d3ca5930e
MD5 30c51150d96172a34d0991bf782a1888
SHA1 47195cbe19f329c99bbc7e123e54f746dcbd0468
SHA512 3eeba111cd36ef68783556dd96a92249d9e225d148797fe946bc66b8cd7af4bdb3d32b9896ec96d68ed30f7938c6a663ce726fa2645d1e9207d5d76eb4cf69e2
SSDEEP 24576:FXioCDKoQAhALqaI6BsTZeWj1TH8/APFpB65WaBGKR48yf3qQenkqnxiyVWYIXKX:AoHdYaIPTZes18/AV2Wai88qQenTnf8Y
MD5 SHA1 SHA512 SSDEEP

Password

infected

3297556040f2565083294ea907bf6904ef7074b3f37695e4661b2c6dc3b047c1.bin

IMPHASH e49b63183dc452ee4abc90a6e47f6582
SHA256 3297556040f2565083294ea907bf6904ef7074b3f37695e4661b2c6dc3b047c1
MD5 5abd128b0550535f9888039668923a3a
SHA1 0fdbc98268bd6e12519301369b3d35bb6844c4b6
SHA512 93c984751749c1b918820d831aea48a468b8a75cda92a6f75bf969d373be3376612d94ad44233b2765b9c7547a7e453d6b62f065e48c5d63b17c1cf128e26234
SSDEEP 49152:qQT9Hq//g6Lv6d4TArruIpNV1k6Krtn569CKRE8aQqz2JA3:NGSSIbIbK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

DeerStealer

Detects DeerStealer malware - JaffaCakes118.

stealer
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

4250

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

407KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

904B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

3297556040f2565083294ea907bf6904ef7074b3f37695e4661b2c6dc3b047c1.bin.zip

3297556040f2565083294ea907bf6904ef7074b3f37695e4661b2c6dc3b047c1.bin

kernel32

msvcrt

generic