stealc | 7ee8a586b2c7b7772a44aed28b4cb7934f13f0939e2573c8adf22cda922790ce

General

Target

7ee8a586b2c7b7772a44aed28b4cb7934f13f0939e2573c8adf22cda922790ce
Size

307KB
MD5

6ead977356a0302d5712c5c72bf82b65
SHA1

efc7e990984a170dd352e8290fedd1d4d748851c
SHA256

7ee8a586b2c7b7772a44aed28b4cb7934f13f0939e2573c8adf22cda922790ce
SHA512

7f0b88c74179866956e2358e21e4700ed9baf1c28712ee78aea689a8027c62aa05c781984c0e3bdca83657b7d34570d5f1e670ef95c91f46f48680c07e53325a
SSDEEP

6144:aAichYtUokCulxMfpbC2e+PuGEFNnE7w+Uw3NKR9hU/W9:StUoH342pSF94wx8KRF9

Score

10^/10

zalupa stealc

Malware Config

Extracted

Family

stealc

Botnet

zalupa

C2

http://95.217.92.42:22

Attributes

url_path
/7db38bfff9324bbe.php

Signatures

Stealc family
stealc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7ee8a586b2c7b7772a44aed28b4cb7934f13f0939e2573c8adf22cda922790ce

Files

7ee8a586b2c7b7772a44aed28b4cb7934f13f0939e2573c8adf22cda922790ce
.exe windows:5 windows x86 arch:x86

8e9e6de8c6aa184371108e1074479bb3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

strncpy
??_V@YAXPAX@Z
memchr
??_U@YAPAXI@Z
strtok
atexit
strtok_s
strcpy_s
vsprintf_s
memmove
strlen
malloc
free
memcmp
??2@YAPAXI@Z
memset
memcpy
__CxxFrameHandler3

kernel32

GetCurrentProcess
RaiseException
GetStringTypeW
MultiByteToWideChar
LCMapStringW
IsValidCodePage
GetOEMCP
lstrlenA
HeapAlloc
GetProcessHeap
VirtualProtect
WaitForSingleObject
CreateProcessA
lstrcatA
VirtualQueryEx
OpenProcess
ReadProcessMemory
WriteFile
GetACP
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
GetProcAddress
GetModuleHandleW
ExitProcess
Sleep
GetStdHandle
GetModuleFileNameW
GetLastError
LoadLibraryW
TlsGetValue
TlsSetValue
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WideCharToMultiByte

Sections

.text
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 121KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

8e9e6de8c6aa184371108e1074479bb3

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

Sections

.text Size: 115KB - Virtual size: 115KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 121KB - Virtual size: 2.2MB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 115KB - Virtual size: 115KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 121KB - Virtual size: 2.2MB

.reloc
Size: 17KB - Virtual size: 17KB