svcstealer | 06bef5b61ad007fb027300ed10a02ff9884a082570cde9434829093cfd3b4907

General

Target
06bef5b61ad007fb027300ed10a02ff9884a082570cde9434829093cfd3b4907
Size 3.6MB
Sample250226-yda8razyd1
SHA256 06bef5b61ad007fb027300ed10a02ff9884a082570cde9434829093cfd3b4907
MD5 deb1a85e75c8f9e45da43bb6acdaba0f
SHA1 c8ed700525263859e3c249a619e5043746c3c1ca
SHA512 08b983b15563cb5bdad328fb1dc9d98bd4c67f8ad20001f41609f317dbc76b1bef0b00bfec0f5eaaa3b7da57465fa15d96a15ae5f07c962d637ce2953c15b2ab
SSDEEP 49152:Gj7p0URkU0wQxMYC7H0b4m5wV61FqaJm41+kpfLDE4D5TVa0IV71YtF1:Gh9H0W610a3pfsYGVp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

svcstealer

Malware Config

Signatures

Detects SvcStealer Payload 1 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
sample	family_svcstealer

Svcstealer family
svcstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06bef5b61ad007fb027300ed10a02ff9884a082570cde9434829093cfd3b4907

File Explorer

06bef5b61ad007fb027300ed10a02ff9884a082570cde9434829093cfd3b4907

.exe 3.6MB

06bef5b61ad007fb027300ed10a02ff9884a082570cde9434829093cfd3b4907

IMPHASH 47087efffcd29d4c0a6c8a29360deeec
SHA256 06bef5b61ad007fb027300ed10a02ff9884a082570cde9434829093cfd3b4907
MD5 deb1a85e75c8f9e45da43bb6acdaba0f
SHA1 c8ed700525263859e3c249a619e5043746c3c1ca
SHA512 08b983b15563cb5bdad328fb1dc9d98bd4c67f8ad20001f41609f317dbc76b1bef0b00bfec0f5eaaa3b7da57465fa15d96a15ae5f07c962d637ce2953c15b2ab
SSDEEP 49152:Gj7p0URkU0wQxMYC7H0b4m5wV61FqaJm41+kpfLDE4D5TVa0IV71YtF1:Gh9H0W610a3pfsYGVp
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects SvcStealer Payload

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WriteFile CreateFileW LoadLibraryA CloseHandle GetProcAddress CreateProcessW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess WriteConsoleW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Sharing