Overview

overview

10

Static

static

10

4820-48-0x...ry.exe

windows7-x64

4820-48-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4820-48-0x0000000000CC0000-0x00000000011C3000-memory.dmp

  • Size

    5.0MB

  • MD5

    92e4b390d1f11aecb5569024158d6b14

  • SHA1

    2c3826ee096b516379711a755b596562f511f686

  • SHA256

    a53e986f5a9673d073637d18e148738d15a2ee853fecf5482c5dc88afeea744f

  • SHA512

    258efc907bb142e1ad1fabce578f38aa892e37f08ca1ddb8d6bd6693ddcab948257ab260488be45ebcd943cbda58b886a967a6527276f52ab7dc33d42e81f0dc

  • SSDEEP

    49152:I/lABPmRam/C1rRvIUqPfLDI6HGxd+Q445TOr90S:9Pmcm/C1tIUkDPHGaQtTOr

Score
10/10
stokstealc

Malware Config

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Stealc family
    stealc
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4820-48-0x0000000000CC0000-0x00000000011C3000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections