Analysis
-
max time kernel
133s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-10-2024 07:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2f38fd8d1e6547ea194ede02d2d103f7.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
General
-
Target
2f38fd8d1e6547ea194ede02d2d103f7.dll
-
Size
525KB
-
MD5
2f38fd8d1e6547ea194ede02d2d103f7
-
SHA1
de54ddb85adc42246282f455cfa6bc95baea4846
-
SHA256
c3c41ea9bf6b0dd5cb4797d2342beac0aa304885e6be13365c606154b63922ce
-
SHA512
f02658cf6fb214599e83040321b59305394a7df0ecb9550f1fb1866c795fe6b7e2fac5216bba4f10ae68ee90fb731fb0fdc35c7471e1792839a576f7c1fec411
-
SSDEEP
6144:bGzCC5wuU6diqel8aaXQDgZxHLo9GQrf/5veypkCyJn7DQkmchwLmsYrP0jp8czO:KaseKaaXQUbr+hVeyfyN/Z7Yms3rz
Malware Config
Extracted
Family
strela
C2
94.159.113.82
Attributes
-
url_path
/server.php
Signatures
-
Detects Strela Stealer payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3968-0-0x00000272C6CC0000-0x00000272C6CE3000-memory.dmp family_strela behavioral2/memory/3968-1-0x00000272C6CC0000-0x00000272C6CE3000-memory.dmp family_strela behavioral2/memory/3968-2-0x00000272C6CC0000-0x00000272C6CE3000-memory.dmp family_strela -
Strela family