2025-07-01_fb062e127887dc881735759b824d96d0_amadey_black-basta_elex_luca-stealer

General

Target
2025-07-01_fb062e127887dc881735759b824d96d0_amadey_black-basta_elex_luca-stealer
Size 14.6MB
Sample250701-e4sqyaz1gt
SHA256 fa047a7845e773c1133f5f7d85e394ed48a5a4af17b0ef457c88c67053907805
MD5 fb062e127887dc881735759b824d96d0
SHA1 c8bbb85bcf529c8f1841771ba5530f5cd53a36cf
SHA512 a6c01ea245f8b3b19f4a4cd445384061b81958c4d6edfe05106cd7ebd8d4fe3f9bf5b248eb50e6c73f8b324068259414d3d502f03a81a56ab9fef388ecfdce8e
SSDEEP 393216:f12gZ3E31MKkrHVricCyCdNzATKEmZA5nEIuRvF1:9Z3mNk5ricCyCdN8Kxu5A
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-07-01_fb062e127887dc881735759b824d96d0_amadey_black-basta_elex_luca-stealer

File Explorer

2025-07-01_fb062e127887dc881735759b824d96d0_amadey_black-basta_elex_luca-stealer

.exe 14.6MB
2025.pyc

21KB

2025-07-01_fb062e127887dc881735759b824d96d0_amadey_black-basta_elex_luca-stealer

IMPHASH 0c47e6ef010186d867803923ed98ad30
SHA256 fa047a7845e773c1133f5f7d85e394ed48a5a4af17b0ef457c88c67053907805
MD5 fb062e127887dc881735759b824d96d0
SHA1 c8bbb85bcf529c8f1841771ba5530f5cd53a36cf
SHA512 a6c01ea245f8b3b19f4a4cd445384061b81958c4d6edfe05106cd7ebd8d4fe3f9bf5b248eb50e6c73f8b324068259414d3d502f03a81a56ab9fef388ecfdce8e
SSDEEP 393216:f12gZ3E31MKkrHVricCyCdNzATKEmZA5nEIuRvF1:9Z3mNk5ricCyCdN8Kxu5A
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

36978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW GetTempPathW WaitForSingleObject Sleep GetExitCodeProcess GetStartupInfoW FreeLibrary LoadLibraryExW CloseHandle GetCurrentProcess LocalFree FormatMessageW MultiByteToWideChar WideCharToMultiByte SetEndOfFile GetProcAddress GetModuleFileNameW SetDllDirectoryW CreateProcessW GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree RaiseException GetCommandLineA CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFullPathNameW RemoveDirectoryW FindClose FindFirstFileExW FindNextFileW SetStdHandle SetConsoleCtrlHandler DeleteFileW ReadFile GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc CompareStringW LCMapStringW GetCurrentDirectoryW FlushFileBuffers GetFileAttributesExW GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW DecodePointer

advapi32

ConvertSidToStringSidW GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW

Sharing

General

Malware Config

Signatures

File Explorer

2025-07-01_fb062e127887dc881735759b824d96d0_amadey_black-basta_elex_luca-stealer

kernel32

advapi32

generic

2025.pyc