Overview

overview

10

Static

static

10

2996-9-0x0...ry.exe

windows7-x64

10

2996-9-0x0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2996-9-0x0000000000400000-0x0000000000661000-memory.dmp

  • Size

    2.4MB

  • MD5

    6b71ddc0a4fd7b1840bee9802f003122

  • SHA1

    a8d797d9aa44e95fc75138ac55913b110e31f159

  • SHA256

    cd645963d6a8fb61f7601fd9eddcf547390821a5f9bb6a746dc1d76de0fb5799

  • SHA512

    0ad34c06e2aca98c8a9f873e64afa9652f15a8b855fb790055344e5bf7773bf575f83e1d7433b60160ee8489c6a85975e2f716b11e1fd550e18cec1e8f0ef8b4

  • SSDEEP

    6144:GKPi8WYtUokCulxMfpb7fefYIQFanE7w+Uw3NKR9hU/:BHtUoH3BfQCF44wx8KR

Score
10/10
default5_dozstealc

Malware Config

Extracted

Family

stealc

Botnet

default5_doz

C2

http://62.204.41.159

Attributes
  • url_path

    /edd20096ecef326d.php

Signatures

  • Stealc family
    stealc
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2996-9-0x0000000000400000-0x0000000000661000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections