strela | 2024090684e8204cdb3a2c7fdfd3adc2dae23a39bkransomwarefloxificedid

Sharing

Copy URL Twitter E-mail

General

Target
2024090684e8204cdb3a2c7fdfd3adc2dae23a39bkransomwarefloxificedid
Size 2.5MB
Sample240906-sccsastbke
SHA256 80dbe5d4af4596e9575515c41c1f189bc56cd866dca7d307396e233b91c37e2f
MD5 84e8204cdb3a2c7fdfd3adc2dae23a39
SHA1 167ba0daa6e00b9cab34e317d2ac16566fdb2dc1
SHA512 476384915865fb2d4705bb04a8257460f1fbae9bbfd1988fcb3f559e5a6ec0390f56e10092cf245ccb54c87d100ebb678ce6637f8b5e7ec5fd88d24c17c8a104
SSDEEP 49152:yL0dIH+mzTBEvmhW328xGaaaJIER7mK5KJ4atqHM5jS0MZeTw/:yodIH+mnBBhWm8xGaAENmK5KJ4ataM5c
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela

Malware Config

Signatures

Detects Strela Stealer payload 1 IoCs

resource	yara_rule
sample	family_strela

Strela family
strela

File Explorer

2024090684e8204cdb3a2c7fdfd3adc2dae23a39bkransomwarefloxificedid

.exe 2.5MB

2024090684e8204cdb3a2c7fdfd3adc2dae23a39bkransomwarefloxificedid

IMPHASH dec6123c88a2b455f11cf81ab05bd3b1
SHA256 80dbe5d4af4596e9575515c41c1f189bc56cd866dca7d307396e233b91c37e2f
MD5 84e8204cdb3a2c7fdfd3adc2dae23a39
SHA1 167ba0daa6e00b9cab34e317d2ac16566fdb2dc1
SHA512 476384915865fb2d4705bb04a8257460f1fbae9bbfd1988fcb3f559e5a6ec0390f56e10092cf245ccb54c87d100ebb678ce6637f8b5e7ec5fd88d24c17c8a104
SSDEEP 49152:yL0dIH+mzTBEvmhW328xGaaaJIER7mK5KJ4atqHM5jS0MZeTw/:yodIH+mnBBhWm8xGaAENmK5KJ4ataM5c
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects Strela Stealer payload

PE Signature issue

Digest

78:5e:47:24:08:54:31:51:7f:34:2c:7a:f3:1e:c3:a9:de:a6:c3:f8:65:5e:3c:1e:79:13:b0:ce:87:83:da:a1

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Canon Inc.,OU=Inkjet System Development Center,O=Canon Inc.,L=Kawasaki-shi,ST=Kanagawa,C=JP

Chains

Apr 18, 2018

CN=Canon Inc.,OU=Inkjet System Development Center,O=Canon Inc.,L=Kawasaki-shi,ST=Kanagawa,C=JP

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Canon Inc.,OU=Inkjet System Development Center,O=Canon Inc.,L=Kawasaki-shi,ST=Kanagawa,C=JP

Serial Number

69:37:56:d7:92:3d:cc:dc:b4:17:fb:ec:3e:b6:be:e9

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 9, 2018 - Apr 21, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

1211938

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Jenkins\workspace\ScanUtility_Win_18_2H_1.5.0_Build\Source\FrontEnd\Release\ScanUtility.pdb

sucmlib

ord84 ord83 ord67 ord72 ord9 ord82 ord79 ord80 _NEW_EncryptPassword@4 ord73 _DELETE_EncryptPassword@4 ord76 ord77 ord65 ord70

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiEnumDeviceInfo

uxtheme

GetThemePartSize IsAppThemed GetCurrentThemeName GetThemeColor DrawThemeParentBackground DrawThemeText OpenThemeData DrawThemeBackground CloseThemeData GetThemeSysColor GetWindowTheme IsThemeBackgroundPartiallyTransparent

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

EnumProcessModules GetModuleBaseNameW

kernel32

VirtualQuery SetStdHandle GetFileType GetStdHandle GetStartupInfoW GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsValidCodePage GetACP GetOEMCP VirtualAlloc GetStringTypeW GetConsoleMode ReadConsoleW GetConsoleCP GetTimeZoneInformation GetDateFormatW GetTimeFormatW RtlUnwind EnumSystemLocalesW SetFilePointerEx WriteConsoleW SetEnvironmentVariableA GetSystemInfo HeapQueryInformation GetModuleHandleExW ExitProcess ExitThread GetCPInfo CreateThread HeapReAlloc HeapAlloc GlobalSize HeapFree GlobalLock GetProcessHeap InitializeCriticalSectionAndSpinCount GlobalUnlock RaiseException GetLastError HeapSize DecodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection FindResourceW FreeLibrary LoadResource LoadLibraryW SizeofResource GetProcAddress LockResource WaitForSingleObject GetTickCount Sleep DeleteFileW InterlockedIncrement InterlockedDecrement GetSystemTimeAsFileTime IsProcessorFeaturePresent IsDebuggerPresent FindResourceExW GetUserDefaultLCID VirtualProtect SearchPathW GetProfileIntW VerifyVersionInfoW VerSetConditionMask lstrcpyW GetFileTime GetFileSizeEx GetFileAttributesExW GetFileAttributesW FileTimeToLocalFileTime SetErrorMode GetWindowsDirectoryW lstrcmpiW DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers GetUserDefaultUILanguage GetSystemDefaultUILanguage CompareStringW LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc GlobalGetAtomNameW InitializeCriticalSection GlobalFlags FileTimeToSystemTime WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetVersionExW GetCurrentThread lstrcmpA ResumeThread SuspendThread SetThreadPriority CreateEventW SetEvent FormatMessageW LocalFree MulDiv GetCurrentProcessId GlobalFindAtomW GlobalAddAtomW LoadLibraryA lstrcmpW GlobalDeleteAtom GetModuleHandleA FreeResource CreateDirectoryW WideCharToMultiByte CopyFileW MultiByteToWideChar GetTempPathW GetLongPathNameW MoveFileW GetShortPathNameW GetCommandLineW GetModuleFileNameW GetCurrentDirectoryW GetSystemDirectoryW GetCurrentThreadId SetLastError EncodePointer OutputDebugStringA LCMapStringW GetDiskFreeSpaceExW QueryPerformanceFrequency GlobalFree CreateFileW GlobalAlloc OpenProcess GetModuleHandleW OutputDebugStringW QueryPerformanceCounter GetCurrentProcess LoadLibraryExW GetTempFileNameW GetLocaleInfoW CloseHandle FindNextFileW FindClose FindFirstFileW ExpandEnvironmentStringsW RemoveDirectoryW IsValidLocale

user32

GetWindowRgn DestroyCursor CreateMenu SubtractRect GetUpdateRect TranslateMDISysAccel DefMDIChildProcW DefFrameProcW DrawMenuBar CharUpperBuffW RegisterClipboardFormatW ModifyMenuW SetMenuDefaultItem CopyIcon GetDoubleClickTime SetClassLongW LockWindowUpdate SetParent SetCursorPos CopyAcceleratorTableW DestroyAcceleratorTable CreateAcceleratorTableW GetKeyboardState ToUnicodeEx MapVirtualKeyExW IsCharLowerW GetKeyboardLayout WaitMessage PostThreadMessageW IsZoomed GetComboBoxInfo ReuseDDElParam UnpackDDElParam InsertMenuItemW TranslateAcceleratorW LoadAcceleratorsW BringWindowToTop MonitorFromPoint UpdateLayeredWindow IsMenu UnionRect EmptyClipboard SetClipboardData EnumDisplayMonitors SetLayeredWindowAttributes NotifyWinEvent InvertRect HideCaret EnableScrollBar MessageBeep GetIconInfo LoadImageW IsRectEmpty SetRectEmpty GetNextDlgGroupItem GetMenuDefaultItem CreatePopupMenu CharUpperW DeleteMenu SendDlgItemMessageA CopyImage RealChildWindowFromPoint IntersectRect ShowOwnedPopups GetMenuItemInfoW DestroyMenu TranslateMessage GetMessageW GetActiveWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW MapVirtualKeyW GetKeyNameTextW RemoveMenu InsertMenuW GetMenuState GetMenuStringW EndPaint BeginPaint ReleaseDC GetWindowDC GetDC TabbedTextOutW GrayStringW DrawTextW IsDialogMessageW SetWindowTextW IsWindowEnabled CheckDlgButton MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetTopWindow GetClassLongW PtInRect MapWindowPoints MessageBoxW AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow RedrawWindow ValidateRect GetForegroundWindow SetActiveWindow TrackPopupMenu GetMenuItemCount GetMenuItemID SetMenu GetMenu SetFocus GetDlgItem SetWindowPlacement GetWindowPlacement DestroyWindow IsChild CreateWindowExW GetClassInfoExW RegisterClassW GetMessageTime GetMessagePos DispatchMessageW RegisterWindowMessageW GetSubMenu LoadMenuW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetDialogBaseUnits SetForegroundWindow InvalidateRgn SetWindowPos LoadStringW GetWindowThreadProcessId GetWindow DrawIconEx DrawEdge ClientToScreen WindowFromPoint ShowScrollBar SetCursor GetCapture SetCapture GetKeyState GetCursorPos ReleaseCapture UpdateWindow TrackMouseEvent DrawFocusRect SystemParametersInfoW DrawStateW FrameRect DrawFrameControl GetClassNameW EqualRect DeferWindowPos BeginDeferWindowPos EndDeferWindowPos SetWindowRgn ScreenToClient PostQuitMessage OffsetRect SetRect EnumChildWindows GetDesktopWindow EnumWindows PostMessageW GetSystemMenu SetTimer GetWindowRect IsIconic KillTimer GetFocus GetParent DrawIcon InflateRect LoadIconW GetAsyncKeyState CreateIcon InvalidateRect AppendMenuW PeekMessageW GetSysColorBrush GetSystemMetrics IsWindowVisible GetDlgCtrlID DestroyIcon CopyRect MapDialogRect FillRect LoadCursorW GetClientRect GetClassInfoW GetSysColor DefWindowProcW CloseClipboard RemovePropW UnregisterClassW IsClipboardFormatAvailable SetPropW GetWindowLongW GetClipboardData SetWindowLongW IsWindow OpenClipboard SendMessageW EnableWindow GetPropW CallWindowProcW DrawTextExW

gdi32

TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CopyMetaFileW GetTextMetricsW CreateRectRgnIndirect PatBlt SetRectRgn DPtoLP CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette GetBkColor EnumFontFamiliesW GetTextCharsetInfo SetPixel CreateDIBSection SetDIBColorTable CreateEllipticRgn Ellipse GetTextColor CreatePolygonRgn Polygon Polyline EnumFontFamiliesExW GetRgnBox OffsetRgn FrameRgn MoveToEx SetPixelV ExtFloodFill SetPaletteEntries FillRgn GetBoundsRect GetWindowOrgEx LPtoDP GetViewportOrgEx GetTextFaceW RoundRect GetObjectW DeleteObject SetBrushOrgEx EndDoc CreateDIBitmap StartDocW SetTextAlign SetStretchBltMode SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetBkMode SelectPalette ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetPixel SelectObject CreateDCW StretchBlt GetDeviceCaps StartPage EndPage CreatePatternBrush CreateRoundRectRgn CreateFontIndirectW GetTextExtentPoint32W CreatePen Rectangle GetDIBits UnrealizeObject CreateBitmap PtInRegion Arc GetObjectType GetClipBox ExcludeClipRect Escape CreateHatchBrush SetTextColor SetBkColor CombineRgn CreateRectRgn CreateSolidBrush GetStockObject PlgBlt SetDIBits CreateCompatibleBitmap CreateCompatibleDC DeleteDC BitBlt

msimg32

TransparentBlt AlphaBlend

winspool.drv

ord203 ClosePrinter EnumPrintersW DocumentPropertiesW OpenPrinterW DeviceCapabilitiesW

advapi32

RegEnumKeyExW RegCloseKey RegCreateKeyExW RegQueryValueExW RegDeleteValueW RegSetValueExW RegOpenKeyW RegDeleteKeyW RegEnumKeyW RegQueryValueW RegEnumValueW RegOpenKeyExW

shell32

CommandLineToArgvW ord43 ExtractIconW SHCreateShellItem SHBrowseForFolderW ord727 SHGetFolderPathW SHGetFileInfoW SHGetPathFromIDListW SHGetSpecialFolderPathW SHGetSpecialFolderLocation SHGetDesktopFolder DragFinish SHAppBarMessage ord155 ord190 SHFileOperationW SHChangeNotify DragQueryFileW SHOpenFolderAndSelectItems ShellExecuteW

comctl32

ImageList_Add ImageList_Replace ImageList_GetImageInfo ImageList_ReplaceIcon ImageList_GetImageCount ImageList_Remove InitCommonControlsEx ImageList_DragShowNolock ImageList_Draw ImageList_DragEnter ImageList_DragLeave ImageList_BeginDrag ImageList_DragMove ImageList_EndDrag ImageList_AddMasked ImageList_Copy

shlwapi

PathRenameExtensionW PathFileExistsW PathSetDlgItemPathW PathIsUNCW AssocQueryStringW PathGetCharTypeW PathIsDirectoryW PathAddBackslashW PathUnquoteSpacesW PathRemoveArgsW PathStripToRootW StrFormatKBSizeW PathCombineW PathRemoveBackslashW PathRemoveFileSpecW PathFindFileNameW PathFindExtensionW PathAppendW PathRemoveExtensionW

ole32

CoDisconnectObject CoInitialize CoCreateGuid OleDuplicateData CreateStreamOnHGlobal ReleaseStgMedium CoCreateInstance RegisterDragDrop CoInitializeEx OleUninitialize OleInitialize CoUninitialize RevokeDragDrop DoDragDrop OleLockRunning CoTaskMemAlloc CoTaskMemFree CoLockObjectExternal OleGetClipboard IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor

oleaut32

LoadTypeLi VarBstrFromDate VariantCopy SysStringLen VariantTimeToSystemTime SystemTimeToVariantTime SysAllocString SysFreeString VariantChangeType VariantClear VariantInit SysAllocStringLen

gdiplus

GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdiplusStartup GdipCloneImage GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipAlloc GdipCreateBitmapFromStream GdipFree GdiplusShutdown GdipDrawImageRectI

oleacc

CreateStdAccessibleObject AccessibleObjectFromWindow LresultFromObject

imm32

ImmGetContext ImmSetConversionStatus ImmSetOpenStatus ImmAssociateContext ImmGetConversionStatus ImmGetOpenStatus ImmReleaseContext

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2024090684e8204cdb3a2c7fdfd3adc2dae23a39bkransomwarefloxificedid

PE Signature issue

sucmlib

setupapi

uxtheme

version

psapi

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

oleacc

imm32

winmm

generic