Behavioral task
behavioral1
Sample
9296dbce8c2243ef03312fdc3b3ec19ad21bb16e56b6b88742f3551de67c6489.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9296dbce8c2243ef03312fdc3b3ec19ad21bb16e56b6b88742f3551de67c6489.exe
Resource
win10v2004-20250207-en
General
-
Target
9296dbce8c2243ef03312fdc3b3ec19ad21bb16e56b6b88742f3551de67c6489.zip
-
Size
3.5MB
-
MD5
05c8b10e14dc47f0fc6d608a62a2d8d5
-
SHA1
f2de3a1ceff42f5f103c0308450fce09c6e8f6b3
-
SHA256
0c59bb8942ce85a4b199d143a03bee76034e49be7186fe650376a50a1030f24d
-
SHA512
6dae3ac23ff7eacdb141a135254fe64625ba6699707dcc249ff1b8d5af7ae86f2367b2ea46dfc60e46a873b3cc6cf8f7b98cf33ff23ea160782d8118496d7124
-
SSDEEP
98304:hVL7MaQDsU2/vrnP1WDBepcKWV8YjD1wpIkt8ixpBRf2zkH:/vMaQo5nTPYtepdKRgpBRf1H
Malware Config
Extracted
stealerium
https://api.telegram.org/bot7570347185:AAEz_VpR809OhOYFdcL_J8sQ3jA3OcwYJ8E/sendMessage?chat_id=
-
url
https://szurubooru.zulipchat.com/api/v1/messages
Signatures
-
Stealerium family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/9296dbce8c2243ef03312fdc3b3ec19ad21bb16e56b6b88742f3551de67c6489
Files
-
9296dbce8c2243ef03312fdc3b3ec19ad21bb16e56b6b88742f3551de67c6489.zip.zip
Password: infected
-
9296dbce8c2243ef03312fdc3b3ec19ad21bb16e56b6b88742f3551de67c6489.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ