Behavioral task
behavioral1
Sample
Built_protected (2).exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
��{�!`.pyc
Resource
win11-20240802-en
General
-
Target
Built_protected (2).exe
-
Size
16.1MB
-
MD5
4f506b6aa469923c97e087eb8b48e161
-
SHA1
d47b6cd0f30419bebddc79c36c61ec5bfda02928
-
SHA256
fed56d0c0c9652cb82271bed04870533c81f91a0320ec97a4a5682af72bb3ab0
-
SHA512
06f2393314e6f21392c5315ba0f42f1d699acd5e986d6d9a3af34741967f17f7e4f9237c9391349b8b5511dde19fc7dcf05c79d1ad95f75eaba956a35f803b85
-
SSDEEP
196608:+/L0E+KyyE5wXfqaHgI+QCwuLuPurErvI9pWjgN3ZdahF0pbH1AYzCtQsNI/Sx3o:+/n+K8MqaHgyhurEUWjqeWxE6nAvw
Malware Config
Signatures
-
A stealer written in Python and packaged with Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/��{�!`.pyc blankgrabber -
Blankgrabber family
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Built_protected (2).exe
Files
-
Built_protected (2).exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 91KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 37KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
��{�!`.pyc