Behavioral task
behavioral1
Sample
9eafe4c1dc4747deec6a985389debe3c88cb80024ae3e5444bb55ac522707dbeN.exe
Resource
win7-20240708-en
General
-
Target
9eafe4c1dc4747deec6a985389debe3c88cb80024ae3e5444bb55ac522707dbeN
-
Size
7.0MB
-
MD5
a372780a695812ccbeac8db92f9d81f0
-
SHA1
4c9d4ba17f2df2d9b5d89243ed5f9089575c55d6
-
SHA256
9eafe4c1dc4747deec6a985389debe3c88cb80024ae3e5444bb55ac522707dbe
-
SHA512
97bae92facea5cd2ac778f6cda8cb92984b4188f2230823b770685e04645068c4149e5c2278f19db7d3fdce5a9e4366a74ac27aaff4ccbeb803f92f093dba857
-
SSDEEP
98304:o5GJtF4RIwybx9guXFBGi0t8T08PfHnVbzwlXix+e1H4BBjyfyB+tiFyIfZnfuFK:cGh6ybH08PfHnVbzwlXfew+tMRBmF
Malware Config
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 9eafe4c1dc4747deec6a985389debe3c88cb80024ae3e5444bb55ac522707dbeN
Files
-
9eafe4c1dc4747deec6a985389debe3c88cb80024ae3e5444bb55ac522707dbeN.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 413KB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qafnomdo Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sojjrspj Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE