Overview

overview

10

Static

static

10

5888-598-0...ry.exe

windows7-x64

1

5888-598-0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5888-598-0x0000000000F70000-0x0000000001608000-memory.dmp

  • Size

    6.6MB

  • MD5

    b9b372c465b991f8e4ccdfb6c1327283

  • SHA1

    145f049d287b2a0a499ce167c8ee3f27614e0863

  • SHA256

    d5961d3b0d036d7eb3f9fd4f74b9d63f3e6423cea4b25b6060fe58d03dfe6795

  • SHA512

    4461ab964c4aab7d50696e60ec5e40afb6dd5a842f1fd92d7cd0dd4ccce6b9b2cf173eb1448eb704e69ebe4fe97888a18b314e4dcae7d7e91a59120f28587857

  • SSDEEP

    98304:UPS2x7fcmFk8X5cnSwyRxpbsEPU6KmsiZ269O:scnxyRHbsE8nmFf

Score
10/10
stokstealc

Malware Config

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Stealc family
    stealc
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 5888-598-0x0000000000F70000-0x0000000001608000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections