Overview

overview

10

Static

static

10

1288-46-0x...ry.exe

windows7-x64

10

1288-46-0x...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1288-46-0x0000000000C70000-0x0000000000ED1000-memory.dmp

  • Size

    2.4MB

  • MD5

    fa9eaa89eff59919ebc8b47e6a208801

  • SHA1

    3964ee2411580c325a191547a3116e0fa095dff4

  • SHA256

    57ae036f0a02512e4fd70429de83f66dde5825e28432a23dd5550e3ee70e5c50

  • SHA512

    6271a0420a63eab66bcd9515bce9fd86e7bf1bb1aae408d6b18fed0067e13beff0632a4ec4159bf5e911798748ba917794bcebf59833d9167ac1d5110ae2329c

  • SSDEEP

    6144:9hcuaqDLkookKe8TmUXvxPh93rgQGZRFxyE7w+Uw3NKR9hU/b9:XDLkodv864PhJrc7FU4wx8KRc9

Score
10/10
default_valencigastealc

Malware Config

Extracted

Family

stealc

Botnet

default_valenciga

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Signatures

  • Stealc family
    stealc
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1288-46-0x0000000000C70000-0x0000000000ED1000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections