stealc | zrs[.]exe

General

Target
zrs.exe
Size 743KB
Sample250924-ftam2scl8w
SHA256 b18cd8298c426e65a3cfa5039f3ff7352aefdfe7e39e26f68882f50962fe9ad3
MD5 9ba80055684790a32b91c827b3a73ed1
SHA1 ad35ed97c29ed9b437177fc7184e094c75515df4
SHA512 526d4cdb6fd9aa2161dd975997f7731dce6fbfc17ef1db0ea3c02393ec35889b3b23715717e7ccb6ec504618b1c8bad872b7048fc039abc8dbaa43db8ea14962
SSDEEP 12288:XwVOm41h6aMIChNqge8bNqDVqlPjzad0H+WaMeY6ReOSoE/:X2eMBThN9eiyVqlPjzU0ezM7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

afdfcvxx stealc

Malware Config

Extracted

Family

stealc

Botnet

afdfcvxx

C2

http://176.46.152.21

Attributes

url_path
/72024bc494bfc6ba.php

rc4.plain

Signatures

Stealc family
stealc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zrs.exe

File Explorer

zrs.exe

.exe 743KB

zrs.exe

IMPHASH 112f19f28f55f461c3d7ad7d3898dd7b
SHA256 b18cd8298c426e65a3cfa5039f3ff7352aefdfe7e39e26f68882f50962fe9ad3
MD5 9ba80055684790a32b91c827b3a73ed1
SHA1 ad35ed97c29ed9b437177fc7184e094c75515df4
SHA512 526d4cdb6fd9aa2161dd975997f7731dce6fbfc17ef1db0ea3c02393ec35889b3b23715717e7ccb6ec504618b1c8bad872b7048fc039abc8dbaa43db8ea14962
SSDEEP 12288:XwVOm41h6aMIChNqge8bNqDVqlPjzad0H+WaMeY6ReOSoE/:X2eMBThN9eiyVqlPjzU0ezM7
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

264516

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleFileNameA LoadLibraryA GetProcAddress GetCurrentProcess CreateFileW QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId MultiByteToWideChar GetStringTypeW GetLocaleInfoEx WideCharToMultiByte InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess WriteFile HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize CloseHandle

Sharing