Overview

overview

10

Static

static

10

2868-439-0...ry.exe

windows7-x64

10

2868-439-0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2868-439-0x0000000000FD0000-0x0000000001658000-memory.dmp

  • Size

    6.5MB

  • MD5

    6ad3fcbbea8afca53c803aeef1397cf2

  • SHA1

    48c802a6badb68340323ec7d142043bea9222ca8

  • SHA256

    ddfacf30fb8616e02b720a738dee76f96023eda2b684be25f4d66ed93830a756

  • SHA512

    451d4273ecdc0c6b62a5ef0188a208a7de87f22d78975a27e24fd7b406e76db1a7d42bf6ec02285edd7d21d6038b55ab94f09378f41391fa9f9470b57cf4f4e7

  • SSDEEP

    98304:d3+c+/5s07GNqEGQor2Zt7nKLwEHI2TbKpEoFT:2GqQu2Zt7n2wZ2ySoF

Score
10/10
stokstealc

Malware Config

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Stealc family
    stealc
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2868-439-0x0000000000FD0000-0x0000000001658000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections