stealerium | 96c62ca985ed966d7c6d274caa5bb41a[.]bin

General

Target
96c62ca985ed966d7c6d274caa5bb41a.bin
Size 1.5MB
Sample240903-bvtp4atajj
SHA256 cf799248f39973dd7dafea05204243991d763dddc77959c60c80096532359eff
MD5 7128735a9b241ebf9a5bf0a2f3104c8a
SHA1 98fccaabda67032dc749dc29239e6460f684f67b
SHA512 66a20b8a5a11c071f13279a5886aa05ff7630ba5de5706ae2341508cd8a63bddbd4881e153cc77eaab68b1e3a0782ec5f254823ec31c0246fa2502b448c7363a
SSDEEP 24576:r23ZbQlvEanDvScCgaKOTpU6yNTyYXfND2cjVnt4mNKUVisQbR+B5fb1ey:r2tQdEanDVEhU6gPND2AymNVzPzwy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealerium

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1216977598710812722/eEJiGM8jVlIOF9WMbphPIuNdIEZhhSSu4T_LZSo0WE_S2YnMqS8z5lz1bmAKfC9V08aI

Signatures

Stealerium family
stealerium

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe

File Explorer

96c62ca985ed966d7c6d274caa5bb41a.bin

.zip 1.5MB
c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe

.exe 1.6MB

96c62ca985ed966d7c6d274caa5bb41a.bin

SHA256 cf799248f39973dd7dafea05204243991d763dddc77959c60c80096532359eff
MD5 7128735a9b241ebf9a5bf0a2f3104c8a
SHA1 98fccaabda67032dc749dc29239e6460f684f67b
SHA512 66a20b8a5a11c071f13279a5886aa05ff7630ba5de5706ae2341508cd8a63bddbd4881e153cc77eaab68b1e3a0782ec5f254823ec31c0246fa2502b448c7363a
SSDEEP 24576:r23ZbQlvEanDvScCgaKOTpU6yNTyYXfND2cjVnt4mNKUVisQbR+B5fb1ey:r2tQdEanDVEhU6gPND2AymNVzPzwy
MD5 SHA1 SHA512 SSDEEP

Password

infected

c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa
MD5 96c62ca985ed966d7c6d274caa5bb41a
SHA1 97842b7b0d381ae027f8a92787ffff84eca2a698
SHA512 66e086fdd0f39f0f166c3d9253805de4095e95b47eee38393a113e2279d4f90c13c8584f3827f45c85b2bca71a9119a48dca6f59d006d4015e9c2f6dafedcde5
SSDEEP 49152:LkTq24GjdGSiqkqXfd+/9AqYanieKdsG:L1EjdGSiqkqXf0FLYW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

1630062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

96c62ca985ed966d7c6d274caa5bb41a.bin

c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe

mscoree

dotnet

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

96c62ca985ed966d7c6d274caa5bb41a.bin

c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe

mscoree

dotnet