Overview

overview

10

Static

static

10

2664-3-0x0...ry.exe

windows7-x64

1

2664-3-0x0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2664-3-0x0000000001210000-0x00000000018A7000-memory.dmp

  • Size

    6.6MB

  • MD5

    95d720624e6327598cc2632301e0c875

  • SHA1

    ee746573506915020be057c81481e529cd2b7237

  • SHA256

    13891c510ea39834d64def080fe8f20059a7668c7fc9fc6a69ab02053969e6e4

  • SHA512

    3bfb7fa2e2e56dd5d1c377cd93e2afb915ddf864f9e5cf3749c3b013cd3b2fad11ff46b3d3bbae7c53dd30466a3dbce58f6473cf131580de16d22c3acef02882

  • SSDEEP

    98304:4YLY0nymBe04c0Ig2ViiYZgqlWJjL2Nlbk1ifCGe6w:4LLiYBlWJ32w1Idw

Score
10/10
levastealc

Malware Config

Extracted

Family

stealc

Botnet

leva

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Stealc family
    stealc
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2664-3-0x0000000001210000-0x00000000018A7000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections