stealerchecker-master[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

stealerchecker-master.zip
Size

39.8MB
MD5

ae3c32a05b2b7b2515a660592f2f3a6d
SHA1

baec690a9c0d29fd55ff277ebec446f6afeb5cc4
SHA256

70a827e7529946f2a47adacc3f45e62c33385058148724abdf0a70da35e9ef03
SHA512

37f11a8e5b639c4296f08e4762c0b84fad88b9d14dc4dd0443b6fb05dde17db4537829a7df8754aa42eeb8e4604715b10c8210956adf0004238f12dc5197d164
SSDEEP

786432:vLoLyLU/q12Bk1zAXEhh0DYqvriI9qkd4sT/tA+DldBFjgB85cEs:vLoLpC1yk1zADD7qbo++DldBamcb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/stealerchecker-master/CommandLine.dll

Files

stealerchecker-master.zip
.zip
stealerchecker-master/.gitattributes
stealerchecker-master/.gitignore
stealerchecker-master/App.config
stealerchecker-master/Checkers.cs
.js
stealerchecker-master/Classes/CheckResult.cs
stealerchecker-master/Classes/DiscordChecker.cs
.js
stealerchecker-master/Classes/Ext.cs
.js
stealerchecker-master/Classes/Log.cs
stealerchecker-master/Classes/Menu.cs
stealerchecker-master/Classes/Options.cs
stealerchecker-master/Classes/Password.cs
stealerchecker-master/Classes/ResponseModel.cs
stealerchecker-master/Classes/Service.cs
stealerchecker-master/Classes/StealerType.cs
stealerchecker-master/CommandLine.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\projects\commandline\src\CommandLine\obj\Release\net461\CommandLine.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 216KB - Virtual size: 215KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
stealerchecker-master/Everything32.dll
.dll windows:4 windows x86 arch:x86

e2215ab9e77ac89648f9e4c61dfefbfc

Code Sign

0e:ae:3b:a4:9c:f8:c1:7c:12:57:cd:df:59:7d:a8:47
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

16/11/2020, 00:00

Not After

17/03/2022, 23:59

Subject

CN=voidtools,O=voidtools,L=Wilmington,ST=South Australia,C=AU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

37:ed:8f:fc:5a:40:a5:99:1a:dc:c9:68:38:2b:1b:28:c3:8b:dd:ce:59:f4:78:73:0e:27:41:85:76:ba:37:ba
Signer

Actual PE Digest

37:ed:8f:fc:5a:40:a5:99:1a:dc:c9:68:38:2b:1b:28:c3:8b:dd:ce:59:f4:78:73:0e:27:41:85:76:ba:37:ba

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
InitializeCriticalSection
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
LoadLibraryW
DeleteCriticalSection
GetModuleHandleW
CloseHandle
WaitForSingleObject
CreateThread
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetCurrentThreadId
GetCommandLineA
GetVersionExA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetLastError
InterlockedDecrement
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize

user32

GetClassInfoExW
RegisterClassExW
CreateWindowExW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
WaitMessage
DestroyWindow
PostQuitMessage
DefWindowProcW
FindWindowW
SendMessageW

Exports

Exports

Everything_CleanUp
Everything_DeleteRunHistory
Everything_Exit
Everything_GetBuildNumber
Everything_GetLastError
Everything_GetMajorVersion
Everything_GetMatchCase
Everything_GetMatchPath
Everything_GetMatchWholeWord
Everything_GetMax
Everything_GetMinorVersion
Everything_GetNumFileResults
Everything_GetNumFolderResults
Everything_GetNumResults
Everything_GetOffset
Everything_GetRegex
Everything_GetReplyID
Everything_GetReplyWindow
Everything_GetRequestFlags
Everything_GetResultAttributes
Everything_GetResultDateAccessed
Everything_GetResultDateCreated
Everything_GetResultDateModified
Everything_GetResultDateRecentlyChanged
Everything_GetResultDateRun
Everything_GetResultExtensionA
Everything_GetResultExtensionW
Everything_GetResultFileListFileNameA
Everything_GetResultFileListFileNameW
Everything_GetResultFileNameA
Everything_GetResultFileNameW
Everything_GetResultFullPathNameA
Everything_GetResultFullPathNameW
Everything_GetResultHighlightedFileNameA
Everything_GetResultHighlightedFileNameW
Everything_GetResultHighlightedFullPathAndFileNameA
Everything_GetResultHighlightedFullPathAndFileNameW
Everything_GetResultHighlightedPathA
Everything_GetResultHighlightedPathW
Everything_GetResultListRequestFlags
Everything_GetResultListSort
Everything_GetResultPathA
Everything_GetResultPathW
Everything_GetResultRunCount
Everything_GetResultSize
Everything_GetRevision
Everything_GetRunCountFromFileNameA
Everything_GetRunCountFromFileNameW
Everything_GetSearchA
Everything_GetSearchW
Everything_GetSort
Everything_GetTargetMachine
Everything_GetTotFileResults
Everything_GetTotFolderResults
Everything_GetTotResults
Everything_IncRunCountFromFileNameA
Everything_IncRunCountFromFileNameW
Everything_IsAdmin
Everything_IsAppData
Everything_IsDBLoaded
Everything_IsFastSort
Everything_IsFileInfoIndexed
Everything_IsFileResult
Everything_IsFolderResult
Everything_IsQueryReply
Everything_IsVolumeResult
Everything_QueryA
Everything_QueryW
Everything_RebuildDB
Everything_Reset
Everything_SaveDB
Everything_SaveRunHistory
Everything_SetMatchCase
Everything_SetMatchPath
Everything_SetMatchWholeWord
Everything_SetMax
Everything_SetOffset
Everything_SetRegex
Everything_SetReplyID
Everything_SetReplyWindow
Everything_SetRequestFlags
Everything_SetRunCountFromFileNameA
Everything_SetRunCountFromFileNameW
Everything_SetSearchA
Everything_SetSearchW
Everything_SetSort
Everything_SortResultsByPath
Everything_UpdateAllFolderIndexes

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
stealerchecker-master/Everything64.dll
.dll windows:4 windows x64 arch:x64

7afe70a8570ab7234dd8fab970b6cbde

Code Sign

0e:ae:3b:a4:9c:f8:c1:7c:12:57:cd:df:59:7d:a8:47
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

16/11/2020, 00:00

Not After

17/03/2022, 23:59

Subject

CN=voidtools,O=voidtools,L=Wilmington,ST=South Australia,C=AU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:bb:ba:74:c4:19:c0:b0:46:88:51:24:cf:9c:8c:96:17:96:74:9e:04:2d:7d:41:05:d3:f0:68:6e:4a:b9:dd
Signer

Actual PE Digest

36:bb:ba:74:c4:19:c0:b0:46:88:51:24:cf:9c:8c:96:17:96:74:9e:04:2d:7d:41:05:d3:f0:68:6e:4a:b9:dd

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
LoadLibraryW
DeleteCriticalSection
GetModuleHandleW
CloseHandle
WaitForSingleObject
CreateThread
RtlLookupFunctionEntry
RtlVirtualUnwind
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetVersionExA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
GetModuleHandleA
ExitProcess
FlsGetValue
TlsFree
FlsFree
SetLastError
GetLastError
TlsSetValue
FlsAlloc
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
RtlUnwindEx
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
HeapSize
GetLocaleInfoA

user32

GetClassInfoExW
RegisterClassExW
CreateWindowExW
WaitMessage
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
DestroyWindow
PostQuitMessage
DefWindowProcW
FindWindowW
SendMessageW

Exports

Exports

Everything_CleanUp
Everything_DeleteRunHistory
Everything_Exit
Everything_GetBuildNumber
Everything_GetLastError
Everything_GetMajorVersion
Everything_GetMatchCase
Everything_GetMatchPath
Everything_GetMatchWholeWord
Everything_GetMax
Everything_GetMinorVersion
Everything_GetNumFileResults
Everything_GetNumFolderResults
Everything_GetNumResults
Everything_GetOffset
Everything_GetRegex
Everything_GetReplyID
Everything_GetReplyWindow
Everything_GetRequestFlags
Everything_GetResultAttributes
Everything_GetResultDateAccessed
Everything_GetResultDateCreated
Everything_GetResultDateModified
Everything_GetResultDateRecentlyChanged
Everything_GetResultDateRun
Everything_GetResultExtensionA
Everything_GetResultExtensionW
Everything_GetResultFileListFileNameA
Everything_GetResultFileListFileNameW
Everything_GetResultFileNameA
Everything_GetResultFileNameW
Everything_GetResultFullPathNameA
Everything_GetResultFullPathNameW
Everything_GetResultHighlightedFileNameA
Everything_GetResultHighlightedFileNameW
Everything_GetResultHighlightedFullPathAndFileNameA
Everything_GetResultHighlightedFullPathAndFileNameW
Everything_GetResultHighlightedPathA
Everything_GetResultHighlightedPathW
Everything_GetResultListRequestFlags
Everything_GetResultListSort
Everything_GetResultPathA
Everything_GetResultPathW
Everything_GetResultRunCount
Everything_GetResultSize
Everything_GetRevision
Everything_GetRunCountFromFileNameA
Everything_GetRunCountFromFileNameW
Everything_GetSearchA
Everything_GetSearchW
Everything_GetSort
Everything_GetTargetMachine
Everything_GetTotFileResults
Everything_GetTotFolderResults
Everything_GetTotResults
Everything_IncRunCountFromFileNameA
Everything_IncRunCountFromFileNameW
Everything_IsAdmin
Everything_IsAppData
Everything_IsDBLoaded
Everything_IsFastSort
Everything_IsFileInfoIndexed
Everything_IsFileResult
Everything_IsFolderResult
Everything_IsQueryReply
Everything_IsVolumeResult
Everything_QueryA
Everything_QueryW
Everything_RebuildDB
Everything_Reset
Everything_SaveDB
Everything_SaveRunHistory
Everything_SetMatchCase
Everything_SetMatchPath
Everything_SetMatchWholeWord
Everything_SetMax
Everything_SetOffset
Everything_SetRegex
Everything_SetReplyID
Everything_SetReplyWindow
Everything_SetRequestFlags
Everything_SetRunCountFromFileNameA
Everything_SetRunCountFromFileNameW
Everything_SetSearchA
Everything_SetSearchW
Everything_SetSort
Everything_SortResultsByPath
Everything_UpdateAllFolderIndexes

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
stealerchecker-master/Image 1105.jpg
.jpg
stealerchecker-master/Image 5.png
.png
stealerchecker-master/Program.cs
.js
stealerchecker-master/Properties/AssemblyInfo.cs
stealerchecker-master/README.md
stealerchecker-master/Telegram.exe
.exe windows:6 windows x64 arch:x64

ac9227547794b5d21c5075139eaf58c4

Code Sign

1f:32:16:f4:28:f8:50:be:2c:66:ca:a0:56:f6:d8:21
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

07/10/2019, 00:00

Not After

06/10/2022, 23:59

Subject

SERIALNUMBER=94349,CN=Telegram FZ-LLC,O=Telegram FZ-LLC,STREET=Business Central Towers\, Tower A\, Office 2301 2303,L=Dubai,ST=Dubai,C=AE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024145

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ae:e2:75:ae:1e:81:d1:10:8c:8e:89:bb:e7:f6:ad:af:7e:3f:17:f7:0f:c7:e6:4e:92:93:84:28:57:5b:88:7a
Signer

Actual PE Digest

ae:e2:75:ae:1e:81:d1:10:8c:8e:89:bb:e7:f6:ad:af:7e:3f:17:f7:0f:c7:e6:4e:92:93:84:28:57:5b:88:7a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Telegram\tx64\out\Release\Telegram.pdb

Imports

kernel32

CopyFileW
GetLastError
DeleteFileW
QueryPerformanceFrequency
QueryPerformanceCounter
CreateFileW
WriteFile
CloseHandle
LocalFree
GetCommandLineW
RaiseException
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
DecodePointer
EncodePointer
GetCurrentProcessId
InitOnceExecuteOnce
RemoveDirectoryW
GetModuleFileNameW
GetEnvironmentVariableW
GetCurrentProcess
WinExec
GetModuleHandleW
GetFileInformationByHandle
FindFirstFileExW
GetFileAttributesW
FindNextFileW
FindClose
LoadLibraryW
GetModuleHandleExW
GetProcAddress
CreateEventW
WaitForMultipleObjects
CreateThread
SetThreadPriority
SetEvent
WaitForSingleObject
ResetEvent
InterlockedFlushSList
FreeLibrary
InterlockedPushEntrySList
InitializeSListHead
ReleaseSemaphore
CreateSemaphoreW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
VerSetConditionMask
VerifyVersionInfoW
GetLocaleInfoW
GetUserDefaultUILanguage
GetTickCount
GetTickCount64
MoveFileExW
FlushFileBuffers
FindFirstFileW
LockFile
UnlockFile
FormatMessageW
LocalAlloc
MultiByteToWideChar
WideCharToMultiByte
GetVersionExA
GetCurrentThreadId
FormatMessageA
CreateEventExW
WaitForMultipleObjectsEx
GetCurrentThread
WaitForSingleObjectEx
IsDebuggerPresent
DebugBreak
CreateSemaphoreA
OutputDebugStringW
ReadFile
SetFilePointerEx
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
GetStdHandle
OutputDebugStringA
CreateEventA
GetModuleHandleA
TryEnterCriticalSection
GetNativeSystemInfo
SetLastError
QueueUserAPC
OpenProcess
QueryFullProcessImageNameW
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
ProcessIdToSessionId
GetModuleHandleExA
lstrcpyW
lstrlenW
lstrcpynW
GlobalAlloc
GlobalFree
InitializeCriticalSectionEx
WakeConditionVariable
GetSystemInfo
InitOnceBeginInitialize
InitOnceComplete
MoveFileExA
InitializeSRWLock
SleepConditionVariableSRW
ReleaseMutex
GetConsoleMode
WriteConsoleW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetProcessAffinityMask
CreateMutexA
GetSystemDirectoryW
LoadLibraryExA
LoadLibraryExW
LoadLibraryA
RtlCaptureContext
SetUnhandledExceptionFilter
TerminateThread
ResumeThread
GetProcessId
VirtualQueryEx
DuplicateHandle
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
GetTempPathA
GetTempFileNameA
GetEnvironmentVariableA
TlsFree
GetProcessHeap
GetSystemTime
SystemTimeToFileTime
InitializeCriticalSectionAndSpinCount
SwitchToFiber
DeleteFiber
CreateFiber
RtlVirtualUnwind
GetFileType
ConvertFiberToThread
ConvertThreadToFiber
SetConsoleMode
ReadConsoleA
ReadConsoleW
ConnectNamedPipe
CreateNamedPipeW
GetOverlappedResult
DisconnectNamedPipe
SetHandleInformation
GetVolumeInformationW
GetLongPathNameW
GetDriveTypeW
GetConsoleWindow
ExitProcess
CompareStringEx
GetLocalTime
TerminateProcess
IsProcessorFeaturePresent
SwitchToThread
GetThreadPriority
UnregisterWaitEx
RegisterWaitForSingleObject
ReadFileEx
PeekNamedPipe
CancelIoEx
SleepEx
WriteFileEx
GetDateFormatW
GetTimeFormatW
GetCurrencyFormatW
GetUserDefaultLCID
GetUserPreferredUILanguages
GetStartupInfoW
GetLogicalDrives
SetEndOfFile
SetErrorMode
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
GetFileAttributesExW
GetFullPathNameW
SetFileTime
GetTempPathW
GetVolumePathNamesForVolumeNameW
DeviceIoControl
MoveFileW
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
GetFileInformationByHandleEx
CompareStringW
LCMapStringW
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
GetExitCodeProcess
CreateMutexW
VirtualAlloc
VirtualFree
WTSGetActiveConsoleSessionId
ExpandEnvironmentStringsW
CreateProcessW
CheckRemoteDebuggerPresent
GlobalUnlock
GlobalLock
GlobalSize
VirtualProtect
VirtualQuery
GetExitCodeThread
RtlPcToFileHeader
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
GetCPInfo
RtlLookupFunctionEntry
UnhandledExceptionFilter
InterlockedPopEntrySList
QueryDepthSList
SignalObjectAndWait
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
SetThreadAffinityMask
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
CreateTimerQueue
RtlUnwindEx
RtlUnwind
SetConsoleCtrlHandler
ExitThread
SetStdHandle
SystemTimeToTzSpecificLocalTime
GetCommandLineA
SetFileAttributesW
GetConsoleOutputCP
GetFileSizeEx
HeapFree
HeapAlloc
IsValidLocale
EnumSystemLocalesW
SetEnvironmentVariableW
HeapReAlloc
HeapSize
HeapQueryInformation
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetUserDefaultLangID

Exports

Exports

??0Animation@rlottie@@AEAA@XZ
??0PlatformMethods@angle@@QEAA@XZ
??0Surface@rlottie@@QEAA@PEAI_K11@Z
??0Surface@rlottie@@QEAA@XZ
??1Animation@rlottie@@QEAA@XZ
??4PlatformMethods@angle@@QEAAAEAU01@$$QEAU01@@Z
??4PlatformMethods@angle@@QEAAAEAU01@AEBU01@@Z
??4Surface@rlottie@@QEAAAEAV01@$$QEAV01@@Z
??4Surface@rlottie@@QEAAAEAV01@AEBV01@@Z
?buffer@Surface@rlottie@@QEBAPEAIXZ
?bytesPerLine@Surface@rlottie@@QEBA_KXZ
?configureModelCacheSize@@YAX_K@Z
?drawRegionHeight@Surface@rlottie@@QEBA_KXZ
?drawRegionPosX@Surface@rlottie@@QEBA_KXZ
?drawRegionPosY@Surface@rlottie@@QEBA_KXZ
?drawRegionWidth@Surface@rlottie@@QEBA_KXZ
?duration@Animation@rlottie@@QEBANXZ
?frameAtPos@Animation@rlottie@@QEAA_KN@Z
?frameRate@Animation@rlottie@@QEBANXZ
?height@Surface@rlottie@@QEBA_KXZ
?layers@Animation@rlottie@@QEBAAEBV?$vector@V?$tuple@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HH@std@@V?$allocator@V?$tuple@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HH@std@@@2@@std@@XZ
?loadFromData@Animation@rlottie@@SA?AV?$unique_ptr@VAnimation@rlottie@@U?$default_delete@VAnimation@rlottie@@@std@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@AEBV54@1_NAEBV?$vector@U?$pair@II@std@@V?$allocator@U?$pair@II@std@@@2@@4@@Z
?loadFromFile@Animation@rlottie@@SA?AV?$unique_ptr@VAnimation@rlottie@@U?$default_delete@VAnimation@rlottie@@@std@@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@_N@Z
?render@Animation@rlottie@@QEAA?AV?$future@VSurface@rlottie@@@std@@_KVSurface@2@_N@Z
?renderSync@Animation@rlottie@@QEAAX_KVSurface@2@_N@Z
?renderTree@Animation@rlottie@@QEBAPEBULOTLayerNode@@_K00@Z
?setDrawRegion@Surface@rlottie@@QEAAX_K000@Z
?setValue@Animation@rlottie@@AEAAXUColor_Type@2@W4Property@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@$$QEAV?$function@$$A6A?AUColor@rlottie@@AEBUFrameInfo@2@@Z@6@@Z
?setValue@Animation@rlottie@@AEAAXUColor_Type@2@W4Property@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UColor@2@@Z
?setValue@Animation@rlottie@@AEAAXUFloat_Type@2@W4Property@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@$$QEAV?$function@$$A6AMAEBUFrameInfo@rlottie@@@Z@6@@Z
?setValue@Animation@rlottie@@AEAAXUFloat_Type@2@W4Property@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@M@Z
?setValue@Animation@rlottie@@AEAAXUPoint_Type@2@W4Property@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@$$QEAV?$function@$$A6A?AUPoint@rlottie@@AEBUFrameInfo@2@@Z@6@@Z
?setValue@Animation@rlottie@@AEAAXUPoint_Type@2@W4Property@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UPoint@2@@Z
?setValue@Animation@rlottie@@AEAAXUSize_Type@2@W4Property@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@$$QEAV?$function@$$A6A?AUSize@rlottie@@AEBUFrameInfo@2@@Z@6@@Z
?setValue@Animation@rlottie@@AEAAXUSize_Type@2@W4Property@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@USize@2@@Z
?size@Animation@rlottie@@QEBAXAEA_K0@Z
?totalFrame@Animation@rlottie@@QEBA_KXZ
?width@Surface@rlottie@@QEBA_KXZ
ANGLEGetDisplayPlatform
ANGLEResetDisplayPlatform

Sections

.text
Size: 50.6MB - Virtual size: 50.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25.8MB - Virtual size: 25.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19.7MB - Virtual size: 22.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: 1024B - Virtual size: 639B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmimed
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 573KB - Virtual size: 573KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
stealerchecker-master/packages.config
stealerchecker-master/services/ForLolz.txt
stealerchecker-master/services/Social.txt
stealerchecker-master/services/forums.txt
stealerchecker-master/services/hostings.txt
stealerchecker-master/services/other.txt
stealerchecker-master/services/proxy.txt
stealerchecker-master/services/sms-activators.txt
stealerchecker-master/services/vps_vds.txt
stealerchecker-master/stealerchecker.csproj
stealerchecker-master/stealerchecker.sln

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 216KB - Virtual size: 215KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

e2215ab9e77ac89648f9e4c61dfefbfc

Code Sign

0e:ae:3b:a4:9c:f8:c1:7c:12:57:cd:df:59:7d:a8:47Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

37:ed:8f:fc:5a:40:a5:99:1a:dc:c9:68:38:2b:1b:28:c3:8b:dd:ce:59:f4:78:73:0e:27:41:85:76:ba:37:baSigner

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 40KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 8KB - Virtual size: 4KB

7afe70a8570ab7234dd8fab970b6cbde

Code Sign

0e:ae:3b:a4:9c:f8:c1:7c:12:57:cd:df:59:7d:a8:47Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

36:bb:ba:74:c4:19:c0:b0:46:88:51:24:cf:9c:8c:96:17:96:74:9e:04:2d:7d:41:05:d3:f0:68:6e:4a:b9:ddSigner

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 57KB - Virtual size: 56KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 4KB - Virtual size: 8KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 176B

.reloc Size: 1024B - Virtual size: 664B

ac9227547794b5d21c5075139eaf58c4

Code Sign

1f:32:16:f4:28:f8:50:be:2c:66:ca:a0:56:f6:d8:21Certificate

Extended Key Usages

Key Usages

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1Certificate

Extended Key Usages

.text
Size: 216KB - Virtual size: 215KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

0e:ae:3b:a4:9c:f8:c1:7c:12:57:cd:df:59:7d:a8:47
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

37:ed:8f:fc:5a:40:a5:99:1a:dc:c9:68:38:2b:1b:28:c3:8b:dd:ce:59:f4:78:73:0e:27:41:85:76:ba:37:ba
Signer

.text
Size: 44KB - Virtual size: 40KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 8KB - Virtual size: 4KB

0e:ae:3b:a4:9c:f8:c1:7c:12:57:cd:df:59:7d:a8:47
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

36:bb:ba:74:c4:19:c0:b0:46:88:51:24:cf:9c:8c:96:17:96:74:9e:04:2d:7d:41:05:d3:f0:68:6e:4a:b9:dd
Signer

.text
Size: 57KB - Virtual size: 56KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 4KB - Virtual size: 8KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 1024B - Virtual size: 664B

1f:32:16:f4:28:f8:50:be:2c:66:ca:a0:56:f6:d8:21
Certificate

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

ae:e2:75:ae:1e:81:d1:10:8c:8e:89:bb:e7:f6:ad:af:7e:3f:17:f7:0f:c7:e6:4e:92:93:84:28:57:5b:88:7a
Signer

.text
Size: 50.6MB - Virtual size: 50.6MB

.rdata
Size: 25.8MB - Virtual size: 25.8MB

.data
Size: 19.7MB - Virtual size: 22.6MB

.pdata
Size: 2.2MB - Virtual size: 2.2MB

.rodata
Size: 4KB - Virtual size: 4KB

.qtmetad
Size: 1024B - Virtual size: 639B

.qtmimed
Size: 315KB - Virtual size: 315KB

_RDATA
Size: 512B - Virtual size: 292B

.rsrc
Size: 39KB - Virtual size: 38KB

.reloc
Size: 573KB - Virtual size: 573KB