General

  • Target

    1980-47-0x0000000001320000-0x0000000001581000-memory.dmp

  • Size

    2.4MB

  • MD5

    d96c9c961b20906a2bc57b07bd251b6d

  • SHA1

    d884630e07e78edbd48c5fed625225f3ce03b28f

  • SHA256

    860ba8e86d60cd72b92aeca4b5c90e563569ac63dd19b079c2225db50602b945

  • SHA512

    f7643720e21c203f95aab00c275a406beb904227c526922023383cd63bc4478cf6b2352161580a1af6975ef4a753920bab2c8408e5942718108148163f60bdfa

  • SSDEEP

    6144:hv2uBso6C6jqCTjx+SdR7XFQGZRFD/aE7w+Uw3NKR9hU/HA9:PBsoNdmNDD7FDi4wx8KRH9

Malware Config

Extracted

Family

stealc

Botnet

default_valenciga

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Signatures

  • Stealc family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1980-47-0x0000000001320000-0x0000000001581000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections