stealc | file[.]exe

General

Target

file.exe
Size

239KB
MD5

da5c79183dabf3510e9c6d76f7c5c087
SHA1

b06a732e61d91b4e2ddc0a288f7472f1c7952271
SHA256

093f37a701ed0a89cb89e00cf665f26760de3a532ef97ecd5d75ce51223f932f
SHA512

c3fef14434ddbbcf14a4e551257376ae0a57884662f22cad24a009569c8e218839423a52d9715307f57565614699f8d66bc524c0f2ce7930a9b4bff9f12ea0ec
SSDEEP

3072:QmrsDjKoXngR6MJvWN3p8+sJkMRuki7ZDzUWXbhvGTPSJ08:r4DueZMFPl5IN1Dz5bePAz

Score

10^/10

cloudytnews stealc

Malware Config

Extracted

Family

stealc

Botnet

CLOUDYTNEWS

C2

http://31.177.109.184

Attributes

url_path
/8331a12a495c21b2.php

Signatures

Stealc family
stealc
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

file.exe

resource
file.exe

Files

file.exe
.exe windows:5 windows x86 arch:x86

9688495fa0fb07674109d4238c74f5ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

rand
strncpy
??_V@YAXPAX@Z
strtok
memchr
strtok_s
??_U@YAPAXI@Z
strcpy_s
vsprintf_s
memmove
strlen
malloc
free
memcmp
??2@YAPAXI@Z
memset
memcpy
__CxxFrameHandler3
_except_handler3

kernel32

GetModuleFileNameW
GetStringTypeW
MultiByteToWideChar
LCMapStringW
lstrlenA
HeapAlloc
GetProcessHeap
VirtualProtect
CreateProcessA
lstrcatA
VirtualQueryEx
OpenProcess
ReadProcessMemory
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
GetProcAddress
GetModuleHandleW
ExitProcess
Sleep
WriteFile
GetStdHandle
GetLastError
LoadLibraryW
TlsGetValue
TlsSetValue
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WideCharToMultiByte
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RaiseException

Sections

.text
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

9688495fa0fb07674109d4238c74f5ee

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

Sections

.text Size: 166KB - Virtual size: 165KB

.rdata Size: 45KB - Virtual size: 45KB

.data Size: 3KB - Virtual size: 2.1MB

.reloc Size: 23KB - Virtual size: 23KB

.text
Size: 166KB - Virtual size: 165KB

.rdata
Size: 45KB - Virtual size: 45KB

.data
Size: 3KB - Virtual size: 2.1MB

.reloc
Size: 23KB - Virtual size: 23KB