Behavioral task
behavioral1
Sample
ReksFn_Leaked.exe
Resource
win11-20240802-en
General
-
Target
ReksFn_Leaked.exe
-
Size
1.6MB
-
MD5
f373449d3a8a4a5a10ebcc6f3dbd601a
-
SHA1
93022ad2211cda8f1ff899efee3fc7de9f55b698
-
SHA256
59b242ccb838fc1ced600ce13a53e43ed58a8b93f5fc14f2d7963c5a4428ffa3
-
SHA512
0ab14db2438be4519a81a04e1158e82f7c5416d8d6f223f159442123d3f9d5d87d3fd182fb0e0a21a341448069d1b0d064057d49fcd53dc4ddc4362b96ef603c
-
SSDEEP
49152:/kTq24GjdGSiqkqXfd+/9AqYanieKdsA:/1EjdGSiqkqXf0FLYW
Malware Config
Extracted
stealerium
https://discord.com/api/webhooks/1271176770942533643/H5281lTVjAT7H3a95PBX1lkSfFpAV_StmxOZwJKlGgUT_zEWP7FBPBJ6DQaa3XcGiXFU
Signatures
-
Stealerium family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ReksFn_Leaked.exe
Files
-
ReksFn_Leaked.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ