stash.rar
- SHA256 666830e77c54ae9101711bf5188ec509ea1e63248338e02cea0a90759ca5fc8e
Password
123
General
- Target stash.rar
- Size 3.6MB
- Sample241108-awlkfa1fjd
- SHA256 666830e77c54ae9101711bf5188ec509ea1e63248338e02cea0a90759ca5fc8e
- MD5 6ad13ace8cd873abb403d0fed31c5c87
- SHA1 be0cd2116b30059a0ffbd7bab9275d81dc591c6d
- SHA512 abbd925904a393ccf77e3ecb62ba0d0a80b00a584c13bc86a92fb8d08f8db736c75747039b6c69de5c841f94a65e6e710845cd3d69951a7b8663741b8bfad130
- SSDEEP 98304:OacFLzzt29YKNm+qFs+q4pMg6KRZRKPH5hSF4hqvM:VcFLftcNm+quopcKdKBo4EvM
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
skuld
C2
-
https://discord.com/api/webhooks/1304194253387206718/6B-P1dSV3aweeugFt1e_YMqZRokv6G5iywdNft3wl2Oy6zXt9Q0DD2bwKuXorZTAtPZ4
Signatures
- Skuld family
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/stash.exe
File Explorer
-
stash.rar.rar 3.6MB
-
Documentation.txt2KB
-
assets/emailpasstoken.txt7KB
-
assets/proxies.txt25KB
-
assets/tokens.txt3KB
-
config.ini461B
-
stash.exe.exe 10.0MB
Documentation.txt
- SHA256 3d73070045edad0e94d11b7da05879196785b47a4c6bf7a023f844dc5d2890f5
- MD5 2f09e36d781ae198b75cc222583da952
- SHA1 ad086e95fc3ce288a6c58a304d1005ee7456b4eb
- SHA512 5a162bc46b938431120f85c59843be6450f7c3206cd5881385e2d49d22ca7ee2a71659c9c86d289655a2b86b403429b3a14c386efdca8dac14bcd2f5a56c15c2
- MD5 SHA1 SHA512
assets/emailpasstoken.txt
- SHA256 688c3947536078cf9a8097f51c277de76e6a6876881106ce7e69c826eea5ca57
- MD5 49b874482f6c2a1be67443f4742586c7
- SHA1 f830a2f5ff007f71c88790f24a0d4421883d05aa
- SHA512 d683ed67fd1667c2b8e7062f763b567284b9687d7fbaef53020df288168c38e0ad9b42895ea4325dd0faa0a0dbc50a634f285442968fc30ec146d845b9f3a84d
- SSDEEP 192:cplANbo3zKTtMtPBWwagUnUro7oBdEIrCRAM7yY2o:CPiteJjQYooT3rCCM71p
- MD5 SHA1 SHA512 SSDEEP
assets/proxies.txt
- SHA256 35b7f208500b584f80e4ee28c7b9b51635d2958600804c0e032edb7e75e9edd1
- MD5 23b4a353eb7d54be3b25c7829738d39e
- SHA1 e6516209ecb4d7e320dca8aee24eeb448ad2a50e
- SHA512 f1f98d983e298feadcac7194e3685ce4e7dd3a973a05d74e025144cb453eff1c48742377b275f8b78d301a1fcb9562d9fc6dd7878f7a2d8c72d6c647443bc021
- SSDEEP 192:Ct6Wl4D/i+65oAgjiUfs/0j+dF2eUg89P3w7Ij4RnrITJXQuaiFHTIxq5Wsg8Sbf:34/DMXTDUsRB6h+Ze0Ly
- MD5 SHA1 SHA512 SSDEEP
assets/tokens.txt
- SHA256 86eb098fe19a775a4096b14241aa7d963999f928fcda78a2120e219537a39417
- MD5 2fd8cd51243f56b6b8eec5d5099db229
- SHA1 82177bbeba9f233c81a29152e787a0d0753852cf
- SHA512 93ea942bef464a67e8bf6df9f46021105c84ad25f1922d329c503080f859aca628a75d6cdbc81438944f4ef1be9dc39842e57b1bc60d8ed219125c8ff8b7107f
- MD5 SHA1 SHA512
config.ini
- SHA256 14492c8597b63225c951db08b526adf6366213a92df6b9407785a10f82d2a73d
- MD5 062df2f5ec022b694dfc957bc5bac9f9
- SHA1 ec95a99c1f7dd20ea9bd85773f49d0e12ab7d79a
- SHA512 ae183c23fca3fc7009a0c4a7eaf917cb07fea86b3fce93caa0dc8534d99cbde582204498da211cee243a008f38dd1336299f0180827cb72cf00c2f443a1c01cb
- MD5 SHA1 SHA512
stash.exe
- IMPHASH d42595b695fc008ef2c56aabd8efd68e
- SHA256 b0681b57abd9c2f2f914dab62343f95d99d1220826a53bfc58d932add5a60ba1
- MD5 0d2168c21b4f8b5939889b1e4326271f
- SHA1 342426bc1a07d4e9c51e2e23eefe799bb84b4bc2
- SHA512 f553ffd69181ebb86f7795f7be1158cc638cf42d3931f0757983d86ba3fc94bd3103a78f806c00e8cae44891cf128d39c68c42be576751bbac196e259b72cf6f
- SSDEEP 98304:JqAJuKBKT5FgjCg0ZTLf7eAO7CFjEED2gCZmVz:AABK5F0en7eAOmFw3Yz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
1
Major OS version
6
Entry point
476864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
4.8MB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
468KB
Virtual Size
798KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
111KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
107KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ