svcstealer | 4db6590cb50ec1a718a17d5fea9dfeba7c8451f4558b893c518cf6672aedc45a

Sharing

Copy URL Twitter E-mail

General

Target
4db6590cb50ec1a718a17d5fea9dfeba7c8451f4558b893c518cf6672aedc45a
Size 615KB
Sample250226-2sfcsswr13
SHA256 4db6590cb50ec1a718a17d5fea9dfeba7c8451f4558b893c518cf6672aedc45a
MD5 445b3781dc7d6ac6a52bec31d74bcd32
SHA1 d8574d03d025d4e888037a4d4a46547c6ba13141
SHA512 fec72af5a3afb6784e7571e16e01ad91573a78a449d0c0faa8ffd4481174369bb0ab672bf90e2d63b37f2093cc60c909a84e700fa331479fdc075f369ba0ce9f
SSDEEP 12288:Tl+79fergMgm+w7dioulRCh3NncLkIug31fCYonRT/AO:Tlc9fergMgm+sdhuls0kIdFKlBo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

svcstealer

Malware Config

Signatures

Detects SvcStealer Payload 1 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
sample	family_svcstealer

Svcstealer family
svcstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4db6590cb50ec1a718a17d5fea9dfeba7c8451f4558b893c518cf6672aedc45a

File Explorer

4db6590cb50ec1a718a17d5fea9dfeba7c8451f4558b893c518cf6672aedc45a

.exe 615KB

4db6590cb50ec1a718a17d5fea9dfeba7c8451f4558b893c518cf6672aedc45a

IMPHASH d5550c38a1ba1bf89267abad76b56796
SHA256 4db6590cb50ec1a718a17d5fea9dfeba7c8451f4558b893c518cf6672aedc45a
MD5 445b3781dc7d6ac6a52bec31d74bcd32
SHA1 d8574d03d025d4e888037a4d4a46547c6ba13141
SHA512 fec72af5a3afb6784e7571e16e01ad91573a78a449d0c0faa8ffd4481174369bb0ab672bf90e2d63b37f2093cc60c909a84e700fa331479fdc075f369ba0ce9f
SSDEEP 12288:Tl+79fergMgm+w7dioulRCh3NncLkIug31fCYonRT/AO:Tlc9fergMgm+sdhuls0kIdFKlBo
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Detects SvcStealer Payload

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

strchr _snprintf strncmp strncpy RtlExitUserThread ZwResumeThread NtQueryInformationThread NtQueueApcThread strstr tolower isalpha sscanf _snwprintf NtQueryInformationProcess RtlRandom __chkstk memcpy _stricmp memset __C_specific_handler

kernel32

UnlockFileEx lstrlenA GlobalLock GlobalAlloc Sleep GlobalUnlock GetProcAddress LoadLibraryA HeapAlloc GetProcessHeap lstrcatA SetFileAttributesA ExitProcess GetComputerNameA VirtualQuery lstrcpynA OpenProcess GetVersionExW lstrcmpiA GetModuleFileNameA CloseHandle GetCurrentProcessId lstrcpyA Process32First VirtualFree CreateRemoteThread VirtualAllocEx Process32Next GetModuleHandleA CreateToolhelp32Snapshot WriteProcessMemory GetCurrentProcess WaitForSingleObject VirtualProtectEx VirtualProtect HeapReAlloc HeapFree VirtualAlloc lstrcmpA ExitThread GetLastError SetLastError GetTempFileNameA WinExec GetTempPathA CreateFileA GetFileSize SetFilePointer MoveFileExA SetEndOfFile GetTickCount WriteFile ReadFile FlushInstructionCache LockFileEx OpenMutexA LocalAlloc GetExitCodeThread GetSystemInfo CreateMutexA GetVersionExA LocalFree DeleteFileA CreateThread

user32

GetForegroundWindow GetSystemMetrics

advapi32

RegSetValueExW CheckTokenMembership FreeSid AllocateAndInitializeSid RegOpenKeyExA GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority RegSetValueExA RegOpenKeyExW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey RegCreateKeyExA RegQueryValueExA

shlwapi

PathCombineA UrlGetPartA PathFindFileNameA StrToIntA StrStrIA

shell32

ShellExecuteExA SHGetFolderPathA

psapi

GetModuleFileNameExA GetProcessImageFileNameA

wininet

InternetCrackUrlA InternetSetOptionA HttpQueryInfoA HttpSendRequestA InternetConnectA InternetOpenA HttpOpenRequestA InternetCloseHandle InternetReadFile

urlmon

URLDownloadToFileA

Name

.text

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

272KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

308KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

4db6590cb50ec1a718a17d5fea9dfeba7c8451f4558b893c518cf6672aedc45a

ntdll

kernel32

user32

advapi32

shlwapi

shell32

psapi

wininet

urlmon

generic