skuld | stash[.]rar

resource
unpack001/stash.exe

stash.rar

SHA256 666830e77c54ae9101711bf5188ec509ea1e63248338e02cea0a90759ca5fc8e
MD5 6ad13ace8cd873abb403d0fed31c5c87
SHA1 be0cd2116b30059a0ffbd7bab9275d81dc591c6d
SHA512 abbd925904a393ccf77e3ecb62ba0d0a80b00a584c13bc86a92fb8d08f8db736c75747039b6c69de5c841f94a65e6e710845cd3d69951a7b8663741b8bfad130
SSDEEP 98304:OacFLzzt29YKNm+qFs+q4pMg6KRZRKPH5hSF4hqvM:VcFLftcNm+quopcKdKBo4EvM
MD5 SHA1 SHA512 SSDEEP

Password

123

Documentation.txt

SHA256 3d73070045edad0e94d11b7da05879196785b47a4c6bf7a023f844dc5d2890f5
MD5 2f09e36d781ae198b75cc222583da952
SHA1 ad086e95fc3ce288a6c58a304d1005ee7456b4eb
SHA512 5a162bc46b938431120f85c59843be6450f7c3206cd5881385e2d49d22ca7ee2a71659c9c86d289655a2b86b403429b3a14c386efdca8dac14bcd2f5a56c15c2
MD5 SHA1 SHA512

assets/emailpasstoken.txt

SHA256 688c3947536078cf9a8097f51c277de76e6a6876881106ce7e69c826eea5ca57
MD5 49b874482f6c2a1be67443f4742586c7
SHA1 f830a2f5ff007f71c88790f24a0d4421883d05aa
SHA512 d683ed67fd1667c2b8e7062f763b567284b9687d7fbaef53020df288168c38e0ad9b42895ea4325dd0faa0a0dbc50a634f285442968fc30ec146d845b9f3a84d
SSDEEP 192:cplANbo3zKTtMtPBWwagUnUro7oBdEIrCRAM7yY2o:CPiteJjQYooT3rCCM71p
MD5 SHA1 SHA512 SSDEEP

assets/proxies.txt

SHA256 35b7f208500b584f80e4ee28c7b9b51635d2958600804c0e032edb7e75e9edd1
MD5 23b4a353eb7d54be3b25c7829738d39e
SHA1 e6516209ecb4d7e320dca8aee24eeb448ad2a50e
SHA512 f1f98d983e298feadcac7194e3685ce4e7dd3a973a05d74e025144cb453eff1c48742377b275f8b78d301a1fcb9562d9fc6dd7878f7a2d8c72d6c647443bc021
SSDEEP 192:Ct6Wl4D/i+65oAgjiUfs/0j+dF2eUg89P3w7Ij4RnrITJXQuaiFHTIxq5Wsg8Sbf:34/DMXTDUsRB6h+Ze0Ly
MD5 SHA1 SHA512 SSDEEP

assets/tokens.txt

SHA256 86eb098fe19a775a4096b14241aa7d963999f928fcda78a2120e219537a39417
MD5 2fd8cd51243f56b6b8eec5d5099db229
SHA1 82177bbeba9f233c81a29152e787a0d0753852cf
SHA512 93ea942bef464a67e8bf6df9f46021105c84ad25f1922d329c503080f859aca628a75d6cdbc81438944f4ef1be9dc39842e57b1bc60d8ed219125c8ff8b7107f
MD5 SHA1 SHA512

config.ini

SHA256 14492c8597b63225c951db08b526adf6366213a92df6b9407785a10f82d2a73d
MD5 062df2f5ec022b694dfc957bc5bac9f9
SHA1 ec95a99c1f7dd20ea9bd85773f49d0e12ab7d79a
SHA512 ae183c23fca3fc7009a0c4a7eaf917cb07fea86b3fce93caa0dc8534d99cbde582204498da211cee243a008f38dd1336299f0180827cb72cf00c2f443a1c01cb
MD5 SHA1 SHA512

stash.exe

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 b0681b57abd9c2f2f914dab62343f95d99d1220826a53bfc58d932add5a60ba1
MD5 0d2168c21b4f8b5939889b1e4326271f
SHA1 342426bc1a07d4e9c51e2e23eefe799bb84b4bc2
SHA512 f553ffd69181ebb86f7795f7be1158cc638cf42d3931f0757983d86ba3fc94bd3103a78f806c00e8cae44891cf128d39c68c42be576751bbac196e259b72cf6f
SSDEEP 98304:JqAJuKBKT5FgjCg0ZTLf7eAO7CFjEED2gCZmVz:AABK5F0en7eAOmFw3Yz
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

1

Major OS version

6

Entry point

476864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

4.8MB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

468KB

Virtual Size

798KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

107KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

stash.rar

Documentation.txt

assets/emailpasstoken.txt

assets/proxies.txt

assets/tokens.txt

config.ini

stash.exe

kernel32

generic

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

stash.rar

Documentation.txt

assets/emailpasstoken.txt

assets/proxies.txt

assets/tokens.txt

config.ini

stash.exe

kernel32

generic