stealc | e71537b867848934002aa039fdc699b5f254ff0e79c123ebad89a6fdde90b533

Resubmissions

16/10/2025, 00:14

251016-ajb58sfv2a10

16/10/2025, 00:10

251016-agfewaal5y10

Analysis

max time kernel
149s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
16/10/2025, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FLiNG-Standalone.287.4.exe
Size 3.4MB
Sample251016-ajb58sfv2a
SHA256 41999a3d0da035ff8068905c90235ea50121329cb0661e38d745974ebf5e3ae2
MD5 cf64c7e2e3897ae5fce3d5414e3d1d27
SHA1 c333a821f1764abe2aed2c1ab27d2349f64e4264
SHA512 3ac217e166ea07cdffb13c949100cf707041c7ee8e842ae4f35e0c529064b610fadcca2782e6de8c8e08e2649487a381f529fda3a53ec31da5ba1394c71d2fb1
SSDEEP 49152:dcOFPISimLMS5M3B3Kul+XYbxzSv199mMc0NWd:F5z0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

fln111 stealc stealer

Malware Config

Extracted

Family

stealc

Botnet

FLN111

http://198.251.84.9

Attributes

url_path
/0f257d2af7624e84.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 6000	4976	FLiNG-Standalone.287.4.exe	78
PID 4976 wrote to memory of 6000	4976	FLiNG-Standalone.287.4.exe	78
PID 4976 wrote to memory of 6000	4976	FLiNG-Standalone.287.4.exe	78
PID 4976 wrote to memory of 6000	4976	FLiNG-Standalone.287.4.exe	78
PID 4976 wrote to memory of 6000	4976	FLiNG-Standalone.287.4.exe	78
PID 4976 wrote to memory of 6000	4976	FLiNG-Standalone.287.4.exe	78
PID 4976 wrote to memory of 6000	4976	FLiNG-Standalone.287.4.exe	78
PID 4976 wrote to memory of 6000	4976	FLiNG-Standalone.287.4.exe	78
PID 4976 wrote to memory of 6000	4976	FLiNG-Standalone.287.4.exe	78
PID 4976 wrote to memory of 6000	4976	FLiNG-Standalone.287.4.exe	78
PID 4976 wrote to memory of 6000	4976	FLiNG-Standalone.287.4.exe	78
PID 4976 wrote to memory of 6000	4976	FLiNG-Standalone.287.4.exe	78
PID 4976 wrote to memory of 6000	4976	FLiNG-Standalone.287.4.exe	78
PID 4976 wrote to memory of 6000	4976	FLiNG-Standalone.287.4.exe	78
PID 4976 wrote to memory of 6000	4976	FLiNG-Standalone.287.4.exe	78
PID 4976 wrote to memory of 6000	4976	FLiNG-Standalone.287.4.exe	78

C:\Users\Admin\AppData\Local\Temp\FLiNG-Standalone.287.4.exe
"C:\Users\Admin\AppData\Local\Temp\FLiNG-Standalone.287.4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Local\Temp\FLiNG-Standalone.287.4.exe
  "C:\Users\Admin\AppData\Local\Temp\FLiNG-Standalone.287.4.exe"
  2⤵
  PID:6000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4976-0-0x0000000000400000-0x0000000000776000-memory.dmp

Download

memory/4976-7-0x00000000008F0000-0x0000000000916000-memory.dmp

Download

memory/6000-8-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/6000-9-0x0000000140000000-0x00000001400CE000-memory.dmp

Download

memory/6000-10-0x0000000140071000-0x0000000140072000-memory.dmp

Download

memory/6000-11-0x0000000140000000-0x00000001400CE000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads