stealc | 1424-73-0x0000000000400000-0x0000000000661000-memory[.]dmp | Triage

Sharing

General

Target

1424-73-0x0000000000400000-0x0000000000661000-memory.dmp
Size

2.4MB
MD5

3fb6afbcd0fbe756e8144348b28e9b4c
SHA1

3b9417d162827a642076a00ca1e406bd054fa163
SHA256

a75e621952255c9b94e147c606260ab5fd35fd69252285c267f58dd2bd946c59
SHA512

4c43a608c317f804e922380915ddf6abe1ae1a41f48d2137010225b0fecefea9f691ef84c3a2db524d852401e2d16b12215a938b763842b25e8d764d3a72b529
SSDEEP

6144:RKPi8WYtUokCulxMfpb7fefYIeHzFanE7w+Uw3NKR9hU/v9:wHtUoH3BfQ2HzF44wx8KR09

Score

10^/10

default5_cap stealc

Malware Config

Extracted

Family

stealc

Botnet

default5_cap

C2

http://62.204.41.159

Attributes

url_path
/edd20096ecef326d.php

Signatures

Stealc family
stealc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1424-73-0x0000000000400000-0x0000000000661000-memory.dmp

Files

1424-73-0x0000000000400000-0x0000000000661000-memory.dmp
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 121KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ