stealc | stealc[.]virus

General

Target
stealc.virus
Size 561KB
Sample251003-lhm2wstrv9
SHA256 6ff3447d30ee218d2c17434bf568296350d9002751df64ad583cc254ce309fac
MD5 49dd890fc09def98c5469e323d90f1a1
SHA1 e9b4cf17727859042abda54ad2a6e0cfab1922d1
SHA512 18b7c8e843fad7ba5d5597e5e51e91aae0ffb6b39ce2a83ed84a8152882efa1fc0720fc7271a6c85c7f2920e3bdb12442c563f545d98628f8573d8e3d5454a09
SSDEEP 12288:olNEYwnZOzxjS/7YYUf2SDbMeY6ReOSoEhLD:olNEFZOzQzVUpDbM1L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

1 stealc

Malware Config

Extracted

Family

stealc

Botnet

1

C2

http://51.89.204.15

Attributes

url_path
/4189fbd5b8e146b5.php

rc4.plain

Signatures

Stealc family
stealc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
stealc.virus

File Explorer

stealc.virus

.exe 561KB

stealc.virus

IMPHASH 5e7f4dd5d3a09f688e799178202edbc5
SHA256 6ff3447d30ee218d2c17434bf568296350d9002751df64ad583cc254ce309fac
MD5 49dd890fc09def98c5469e323d90f1a1
SHA1 e9b4cf17727859042abda54ad2a6e0cfab1922d1
SHA512 18b7c8e843fad7ba5d5597e5e51e91aae0ffb6b39ce2a83ed84a8152882efa1fc0720fc7271a6c85c7f2920e3bdb12442c563f545d98628f8573d8e3d5454a09
SSDEEP 12288:olNEYwnZOzxjS/7YYUf2SDbMeY6ReOSoEhLD:olNEFZOzQzVUpDbM1L
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

95579

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleFileNameA LoadLibraryA GetProcAddress GetCurrentProcess CloseHandle QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId MultiByteToWideChar GetStringTypeW GetLocaleInfoEx WideCharToMultiByte InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess WriteFile HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize CreateFileW

Sharing