build.zip
- SHA256 76621536f29a688e86b6964cbb88f51813f4858c57f375bc7387b7e2b138cdb6
General
- Target build.zip
- Size 2.9MB
- Sample240819-bckpgaycjl
- SHA256 76621536f29a688e86b6964cbb88f51813f4858c57f375bc7387b7e2b138cdb6
- MD5 f765b3df8015eb734dfa3af189dd02dc
- SHA1 faee5d65796e27409633594fdac32db3593b66bc
- SHA512 344282d24f58325bf940477d48b692ec765c0d026801ccb331918b32120955952cd08a704c475f45a70688266b36d5dbc4ade77c159eda1e7cfb6bb9d0b8b236
- SSDEEP 49152:Z932cD027AAqpXpotYO29n6ofGbbuk8V0g/uUneRqNrXJqKAzRMnIHltj:v2NSAAqpXmX25PGblJOBneRqNr5qKUyS
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
stealerium
C2
-
https://discord.com/api/webhooks/1274884697553633374/cgftOG3YEk0chdJS0rgECfP4MTRVQH9YeUPXq8YHtw-rsy_AIXIhYb8KMgXRIBxfhD--
Signatures
- Stealerium family
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/build.exe unpack001/stub.exe
File Explorer
-
build.zip.zip 2.9MB
-
build.exe.exe 1.6MB
-
stub.exe.exe 1.6MB
-
stub.exe.config759B
build.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7c9347b21eb3fde58070c1326ca7f6c9239dc2f0969b413ae4c6539b8f306f43
- MD5 ddc61a6501b0b39fe5eeb1ec81b022b8
- SHA1 4a139f3a638a398812b99797c527cc62c37b6462
- SHA512 d49c7419009e21e7622cc13708d48a8257c5cc525743aecaea020b604db27702d9c5a868028c555d458b96051a44aec1635005fab8e3371580cd47ad14d5fd4e
- SSDEEP 49152:7kTq24GjdGSiqkqXfd+/9AqYanieKdsH:71EjdGSiqkqXf0FLYW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1630062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6c5935bcddaa1d4f809487f66db758e892cc0a7fd7704d138904bc879644ea1f
- MD5 6627adf7167ee571e8fd6c8b1a0e8ae3
- SHA1 03b9112660ee73c59d84e219f15bf24ae9df48db
- SHA512 e05896a6e0d09d4dafeb2467395ca06ae1e728a4aa079041dea82940caeb71646984604fdeea482748423b10257b8462db4f573682f9f719939143fdb5691c60
- SSDEEP 49152:19Tq24GjdGSiqkqXfd+/9AqYanieKd0U:1YEjdGSiqkqXf0FLYW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1630126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stub.exe.config
- SHA256 67818858dae8a4d85a158d68ca50bfef345a730dbf12461cfb700f30edee460c
- MD5 a40b70b19e717b2628d2662b61e69f99
- SHA1 c3d59349659cd82fb6b8c093a3df72846541573a
- SHA512 2dfca6af0d7daeafa4803fbf971843e70678eb2ecc73f8559d39a617721c3a9362eba9fd4d158a1227a50d96b6711a9bd9f694eb10532e7caa9694aefa81b794
- MD5 SHA1 SHA512