DownloadRunExeId
DownloadRunExeUrl
DownloadRunModId
DownloadUpdateMain
InjectApcRoutine
InjectNormalRoutine
SendLogs
WriteConfigString
Behavioral task
behavioral1
Sample
Flasher.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Flasher.exe
Resource
win10v2004-20250217-en
Target
Flasher.exe
Size
573KB
MD5
eff931961e9134a9945fadd29df90ff7
SHA1
cc27b1d909b14a01a88d27545007703aa9c82d36
SHA256
f126cbaecfd33f8026cf15a223857503f147b947dccb7a5da727ea19a4a5963b
SHA512
5a5bdd3458b64ff434598dd09c98d2ef31945288560d2995ec6200ed0894a71e2522d5ffbdb23f9fcd59159bb811983b0c2862b688cff5fc7fbb50e9a113f290
SSDEEP
12288:ntuH9xWLgvHIh+bOH1JcyDXFJgazKHWs88/vNKI8e:nto9xWLgvHI+OHPcy7T7zBs88/vgZe
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
resource | yara_rule |
---|---|
sample | family_svcstealer |
Checks for missing Authenticode signature.
resource |
---|
Flasher.exe |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
strchr
_snprintf
strncmp
strncpy
RtlExitUserThread
ZwResumeThread
NtQueryInformationThread
NtQueueApcThread
strstr
tolower
isalpha
sscanf
_snwprintf
NtQueryInformationProcess
RtlRandom
__chkstk
memcpy
_stricmp
memset
__C_specific_handler
UnlockFileEx
lstrlenA
GlobalLock
GlobalAlloc
Sleep
GlobalUnlock
GetProcAddress
LoadLibraryA
HeapAlloc
GetProcessHeap
lstrcatA
SetFileAttributesA
ExitProcess
GetComputerNameA
VirtualQuery
lstrcpynA
OpenProcess
GetVersionExW
lstrcmpiA
GetModuleFileNameA
CloseHandle
GetCurrentProcessId
lstrcpyA
Process32First
VirtualFree
CreateRemoteThread
VirtualAllocEx
Process32Next
GetModuleHandleA
CreateToolhelp32Snapshot
WriteProcessMemory
GetCurrentProcess
WaitForSingleObject
VirtualProtectEx
VirtualProtect
HeapReAlloc
HeapFree
VirtualAlloc
lstrcmpA
ExitThread
GetLastError
SetLastError
GetTempFileNameA
WinExec
GetTempPathA
CreateFileA
GetFileSize
SetFilePointer
MoveFileExA
SetEndOfFile
GetTickCount
WriteFile
ReadFile
FlushInstructionCache
LockFileEx
OpenMutexA
LocalAlloc
GetExitCodeThread
GetSystemInfo
CreateMutexA
GetVersionExA
LocalFree
DeleteFileA
CreateThread
GetForegroundWindow
GetSystemMetrics
RegSetValueExW
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegOpenKeyExA
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
RegSetValueExA
RegOpenKeyExW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
PathCombineA
UrlGetPartA
PathFindFileNameA
StrToIntA
StrStrIA
ShellExecuteExA
SHGetFolderPathA
GetModuleFileNameExA
GetProcessImageFileNameA
InternetCrackUrlA
InternetSetOptionA
HttpQueryInfoA
HttpSendRequestA
InternetConnectA
InternetOpenA
HttpOpenRequestA
InternetCloseHandle
InternetReadFile
URLDownloadToFileA
DownloadRunExeId
DownloadRunExeUrl
DownloadRunModId
DownloadUpdateMain
InjectApcRoutine
InjectNormalRoutine
SendLogs
WriteConfigString
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE