Behavioral task
behavioral1
Sample
Built_protected.exe
Resource
win11-20240802-en
General
-
Target
Built_protected.exe
-
Size
16.5MB
-
MD5
4079168a1700f0512de865a1111e23c6
-
SHA1
9c3e0f923609f4f90b9015519e83b6fa90b07ff5
-
SHA256
21d1e94b572a4cad3ef468670de848cd8f171b786aabfe7dc2ea6a48e9eef25f
-
SHA512
99627d3f79b22e3cfe3c3cff8f0cd75d71bb78b78ccc84fb9283435771beb3a9d12d6a692f1ee4879e26dbd5aedbcebf8b82c2b940c43b6f2c3a5da3e3b83dd3
-
SSDEEP
196608:UUo6o7rMyE22G8T7+QCwuLuPurErvI9pWjgN3ZdahF0pbH1AYzCtQsNI/Sx3mUw:nF4rMDG8TXhurEUWjqeWxE6nAvw
Malware Config
Signatures
-
A stealer written in Python and packaged with Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/��{�!`.pyc blankgrabber -
Blankgrabber family
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Built_protected.exe
Files
-
Built_protected.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 91KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 37KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
��{�!`.pyc