MoonStealer-main.zip
- SHA256 cc16889abbfe38386a105e602d856c512a2dfd51795ad55092ab27983e70b3b5
Overview
overview
10Static
static
10MoonSteale...er.exe
windows7-x64
10MoonSteale...er.exe
windows10-2004-x64
10MoonSteale...px.exe
windows7-x64
5MoonSteale...px.exe
windows10-2004-x64
5out.exe
windows7-x64
out.exe
windows10-2004-x64
MoonSteale...der.py
windows7-x64
3MoonSteale...der.py
windows10-2004-x64
3MoonSteale...ll.bat
windows7-x64
10MoonSteale...ll.bat
windows10-2004-x64
10MoonSteale...ain.py
windows7-x64
3MoonSteale...ain.py
windows10-2004-x64
3MoonSteale...rt.bat
windows7-x64
1MoonSteale...rt.bat
windows10-2004-x64
1Behavioral task
behavioral1
Sample
MoonStealer-main/MoonStealer_assets/upx/updater.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
MoonStealer-main/MoonStealer_assets/upx/updater.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
MoonStealer-main/MoonStealer_assets/upx/upx.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
MoonStealer-main/MoonStealer_assets/upx/upx.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
out.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
out.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
MoonStealer-main/builder.py
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
MoonStealer-main/builder.py
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
MoonStealer-main/install.bat
Resource
win7-20240729-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral10
Sample
MoonStealer-main/install.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral11
Sample
MoonStealer-main/main.py
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
MoonStealer-main/main.py
Resource
win10v2004-20250129-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
MoonStealer-main/start.bat
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
MoonStealer-main/start.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target MoonStealer-main.zip
- Size 561KB
- Sample250131-e8bm8a1jar
- SHA256 cc16889abbfe38386a105e602d856c512a2dfd51795ad55092ab27983e70b3b5
- MD5 552ae3e1d5b29589e4f721676f356e95
- SHA1 116a2585ec1b114a2c23cf4c99e58fd3adfe5819
- SHA512 e382ac33e8b417fc32d7baf835699633d418ebb133384fbb07aa05aeffc6024a2a91e68c294a93c00211367ea1179cf4ac24f66659c7723debc4c9266b5f345c
- SSDEEP 12288:5mVEp8K9G80iPAi52M7zIDBrqAItEGN61HJpA118J7rYSc0:5mKpfvTbkrqAItD6b6D8J7kSv
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.8
Botnet
-
Default
C2
-
23.94.99.6:6606
-
23.94.99.6:7707
-
23.94.99.6:8808
-
23.94.99.6:4782
Mutex
-
qdWLYmlsI9yW
Attributes
-
delay
3
-
install
true
-
install_file
required.exe
-
install_folder
%AppData%
aes.plain
Signatures
- Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/MoonStealer-main/MoonStealer_assets/upx/updater.exe family_asyncrat - Asyncrat family
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule static1/unpack002/out.upx patched_upx -
resource yara_rule static1/unpack001/MoonStealer-main/MoonStealer_assets/upx/upx.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/MoonStealer-main/MoonStealer_assets/upx/updater.exe unpack001/MoonStealer-main/MoonStealer_assets/upx/upx.exe unpack002/out.upx
File Explorer
-
MoonStealer-main.zip.zip 561KB
-
MoonStealer-main/LICENSE6KB
-
MoonStealer-main/MoonStealer_assets/upx/updater.exe.exe 48KB
-
MoonStealer-main/MoonStealer_assets/upx/upx.exe.exe 525KB
-
out.upx.exe 2.0MB
-
MoonStealer-main/README.md4KB
-
MoonStealer-main/builder.py6KB
-
MoonStealer-main/install.bat95B
-
MoonStealer-main/main.py48KB
-
MoonStealer-main/main.spec678B
-
MoonStealer-main/requirements.txt83B
-
MoonStealer-main/start.bat35B
MoonStealer-main/LICENSE
- SHA256 a2010f343487d3f7618affe54f789f5487602331c0a8d03f49e9a7c547cf0499
- MD5 65d3616852dbf7b1a6d4b53b00626032
- SHA1 82da472f6d00dc5f0a651f33ebb320aa9c7b08d0
- SHA512 1eb4436f8d58766cbe99db97e5e8c0db8a706376afd291c337de1ba7a6b066d3791dc85ad034bdd54ea336bed6e6e8e7a037d8b04b2773c9c7517b9d9921d1fa
- SSDEEP 192:uk5MToKgfbxcjtv2sFtYH1Y1mzLKRL0WWJ:DAvg1cjT4ImKJ0t
- MD5 SHA1 SHA512 SSDEEP
MoonStealer-main/MoonStealer_assets/upx/updater.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e57f42b4a9e3305785a2a6e1ffb14fa82d90d5094e8e5ecb3cd8fcb903637d92
- MD5 403e30df6166df14523e6f820703241a
- SHA1 9f00e1baf4313fd33a513251b494d2340e88a91b
- SHA512 885dfaf6fd4c14dcfa223a7a8cb3258b4c81da589eacb5d2da5d4ffbeb594ec2c9483ab1d75fc7a9b6cd1567cf82f94ded18ace4e14540f2f48033eed2f16a44
- SSDEEP 768:qu4f9TskvpDWUPlNxmo2qbebAN6JunAjZPIBj8wucDO30b9IxgaOMtV+rhG/BDZ3:qu4f9Tswb2FbNuA6BGgb9I6aH3+4Jdm2
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MoonStealer-main/MoonStealer_assets/upx/upx.exe
- SHA256 a4240ea0e8a916d15f8391edef9705ab4de1f516dd360f0a336c5358686d434b
- MD5 8a98406e32ed6139bd9e75342d452948
- SHA1 ed77737b88a7351d0bc5f542ddb7ce84f8f95588
- SHA512 f5b17975560d97308a6ee66845225715e82bade9df7bc36821c76fe67fcf8d22929bf21b85e28dd11b7399d0109ab1f3786fd2010c2e5023d3a93d2bd5cf678b
- SSDEEP 12288:fOHsWPQsJdQmiR0eYG16fyP8RHzS75CaNgMYqIW7I2:2QmiWK16rRHzS7U6ip2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2102592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
522KB
Virtual Size
524KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 a84e70f79c993beadbfcade43bf51f63d841ecd27eaced77c0976e70fba9de69
- MD5 6f9617311d2fb9cbbfabc57ed46dbd14
- SHA1 899b535d0d942c60d2d95fa4cbe4a80408ccb8bb
- SHA512 1a71de62b8e6798889525ae3479322d93f2aaa35075adefe49d4d820b9542955ae15638046c78ab83c02da628140ece11dab30c1939e440f5260a012024b277b
- SSDEEP 24576:Y7J+UM2Sqzae2jctbEjviXrGBZUlOQeZp9G9SPkeDkFkH1:dUBacRiBiEQGP
- MD5 SHA1 SHA512 SSDEEP
-
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
850KB
Virtual Size
849KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
MoonStealer-main/README.md
- SHA256 5c6aacee573a41f9beda698fd9c40fa5ba6cf188c079989975519d3b7a13a4f4
- MD5 ecad64cfc4c94691a272192ed796778b
- SHA1 5161a5b26464754e632b44b98cd90f01f7a57b4c
- SHA512 090142577ac94201788bed8d5979751f18bcbc1c4de0077e9076708546a95e6451a3c365525aca7b959aa84595cacb191ec4053e0bed915eee9ba4bcb677b6f0
- SSDEEP 96:UIJ6BtIgsUXMI21IHVAH7ndJFK5ReEQkQgbNxNaE+BWm7GwUhdt:U9BtBd6wVAH7vM89knNxNaxqt
- MD5 SHA1 SHA512 SSDEEP
MoonStealer-main/builder.py
- SHA256 8d84f48da564d51a2ca621554179e82f9bf12ca5db097977a2146b373c6fad32
- MD5 48d51f59c5177750328641c797c0f478
- SHA1 618ccea3f2ae5e435430e779579f9cd2c84c1dd2
- SHA512 918ff4b93338e9c75542b04c3bd1ba12b5562660d64eca679e9bc782bf8a81ea31efdfa779e270a96f2da641e694a86a0e0d433d9bfb95c70bd72d3051396ead
- SSDEEP 96:SFvQsZlbpdIV9ll+zVHJllFSYUCSPlbpdIV1ll+zVHRllFiYbRZfY7DGZ2we8Gzo:IZlbpd8QztMPlbpd8IztbZf0GZzjv4A7
- MD5 SHA1 SHA512 SSDEEP
MoonStealer-main/install.bat
- SHA256 9fa41aabbfef72bc8a6d3342b2f399a82c2f6ec7bc14e46bc1d3dcacd4f5d3c3
- MD5 7c928c6358b7d280aff4be1ff2ac7c29
- SHA1 6e9014938d6d05791cfba2473397ad7e39ae5881
- SHA512 a6558bb4e546cd87b7787117741d01e8ed936b3ecaef32855533b1e4cd54d068e9f75ec560304a445c56605aebec8f2070f51c2e3b20661a3688c8a811677dd9
- MD5 SHA1 SHA512
MoonStealer-main/main.py
- SHA256 f4c4c2476408c644b2aebf613d42ef361e2a5630c7a62c505bf4c319aace6293
- MD5 ce6bbfc8f624a0590495fce46648d3f7
- SHA1 182880bb1eccc344455228afe6eabc28b0d25875
- SHA512 2cb207f86bd64ae448e26d456a9970bec46d7e196209983a9e1c822136248b6c4795bad4b58809d4cf1a74bdd46d5e7ff56b0c2933e5a94dffd7e414284ea58f
- SSDEEP 768:gDaj4Pvv8PZmsyhTuVJ7AWyykW2WMWLWLWLWQW7WP2uL12oqcW7WFufQtRPPWMCd:yaj4Pvv8PjyhCV1T2aRtufK8MK
- MD5 SHA1 SHA512 SSDEEP
MoonStealer-main/main.spec
- SHA256 c39c342a3d134d3fdfd905390b3eabd2da3786edc5560d8a7b0476dc014cdb24
- MD5 8fe61afd8c708a41aea253e055dcaeaf
- SHA1 a9e090b721442ca980f7aefce339d5cc22311b24
- SHA512 4e83c38aaa0eea2e98458a3d1b64a6e6363f3c3d5bb6c90b61138be79b9e8ffdee292f6cbc70b2e31ebaffb904cd5fcd5e958d713b740f7465ed5204ba67e50a
- MD5 SHA1 SHA512
MoonStealer-main/requirements.txt
- SHA256 051757cff6fbd529c0d73c1470390123e04122b482c55f6fc7b4a5715433e446
- MD5 9e93bfb567eb409e31c69872d1b051dd
- SHA1 0099d3815a4a16c43c32a0d8f2f7e7072f937192
- SHA512 2d6add165c94a37980ab41ff8aa99f7fc844cf0751fe69a49493862be601fe1f3ed230f54049db20f6f95553f8c3ca0fb79bf4a113f3dda863278db304f99af6
- MD5 SHA1 SHA512
MoonStealer-main/start.bat
- SHA256 03aac700e872f2a2a05f79990504f7eb39950ccfd539e818e8586ebb7ef55158
- MD5 e20d4392cbac1ef4c73f93c6e4a828b1
- SHA1 5e28e0f4967f35c7bf1942813265499f2c329e09
- SHA512 7af88983c9aabee84f7154724cf95b47a9c39eb8cde91795b56e5bb5d90be6c256358f871bf98b3976b205107c420b09d44758f2640d96e125aaef8ee85d671d
- MD5 SHA1 SHA512