Overview

overview

10

Static

static

10

1796-117-0...ry.exe

windows7-x64

1

1796-117-0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1796-117-0x0000000000DF0000-0x0000000001478000-memory.dmp

  • Size

    6.5MB

  • MD5

    edf08a8d809b32d71cc4cfd75b316731

  • SHA1

    6d51a955972d2234ad5d1a81b645093f63f31eb3

  • SHA256

    2039ef3a972d4ed984a8a9008c15c67188aee1f6ef0c7222f830af6d58bd2fc9

  • SHA512

    abd86fbe504c457d30d5a55725f37cc363ac91c8e2f939b8860688088f8326c3bc4b3e6fa4845772ef5536a48a073552fd37be198579ca5f944b89c77b5230c4

  • SSDEEP

    98304:lyzgodc94JZpevkV9MssmaypkF+xyqW7aDzy+MIc4PMpigBxr:3Xs/pkF+xyqqGy+xZPMc2xr

Score
10/10
marsstealc

Malware Config

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Stealc family
    stealc
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1796-117-0x0000000000DF0000-0x0000000001478000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections