Behavioral task
behavioral1
Sample
virus.zip
Resource
win10v2004-20250314-en
General
-
Target
virus.zip
-
Size
3.6MB
-
MD5
fe4ff14111a8984d26662416e9611ee3
-
SHA1
0748db31ee7cda96c5944d6ff3e96dcd6f08f65d
-
SHA256
e3c515df9483a0da33748fdd696122328a97fdc8f39d509f6e2f62e068bbb607
-
SHA512
18d79665805ec66077e94f1db72fc01c2006dfcdb91f0a8522da96915e95104ae1cbf9ad35bcd1d70ec6c06f547e2b20d6f3656d31d63b6defaebbcb89b889cc
-
SSDEEP
98304:+kqXf0FlL9nrYAWCLbi6sfLxkuahjCOeX9YG9see5GnRyCAm0makxH131:+kSIlLtzWqZAkuujCPX9YG9he5GnQCA8
Malware Config
Extracted
stealerium
https://api.telegram.org/bot8069076644:AAFfDEdqiBbvc_SCYskJFW3YjC9t_kBO0wI/sendMessage?chat_id=
-
url
https://szurubooru.zulipchat.com/api/v1/messages
Signatures
-
Stealerium family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/iOS_UNiX_Bypass.exe
Files
-
virus.zip.zip
-
iOS_UNiX_Bypass.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ