Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-10-2024 01:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1970d38e7fa45a46e792372a19d890541c87d1007ddedd53858b6df6728d72ff.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
General
-
Target
1970d38e7fa45a46e792372a19d890541c87d1007ddedd53858b6df6728d72ff.dll
-
Size
278KB
-
MD5
f50df05ae6238189b43ce1b1101f67c6
-
SHA1
eee86d826e9ee48ab5dd0c0965277d0868b9df89
-
SHA256
1970d38e7fa45a46e792372a19d890541c87d1007ddedd53858b6df6728d72ff
-
SHA512
817d64e87d12cf76497f5ee482707db24ac0fbe131598636992f7ec0efb240bd3c59079fc9366eae4e03f4e1ce39990b05945e54d580ae9ba1b0f79223d0681f
-
SSDEEP
6144:DMgNhY/LbOxL5HmXQ3w8rr984zwpzNjC7uJ4/VhTU:DtNQIL5Hmg3b6Ewz6U
Malware Config
Extracted
Family
strela
C2
94.159.113.48
Attributes
-
url_path
/server.php
Signatures
-
Detects Strela Stealer payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4384-0-0x00000197D0810000-0x00000197D0833000-memory.dmp family_strela behavioral2/memory/4384-1-0x00000197D0810000-0x00000197D0833000-memory.dmp family_strela behavioral2/memory/4384-2-0x00000197D0810000-0x00000197D0833000-memory.dmp family_strela