stealc | 1f59e3d31c17a80eec1db5396e2201db[.]exe

General

Target
1f59e3d31c17a80eec1db5396e2201db.exe
Size 735KB
Sample251225-nyfzmawkbv
SHA256 48cdd76bee9557da7d9100caa6bf151a3efec0e32f4cbcd3ab14fcf5311715d4
MD5 1f59e3d31c17a80eec1db5396e2201db
SHA1 d27c7b06b1dd7a79e52cc87b50aea5741ef91cc8
SHA512 5d7c82cc594fa41ae4a78a3db63117d6bfec7fa36ae03ef99a86b38be50d2f4b9872c92eae7302dd62d13c5e9bd6bed5078c6e3d0876785caa2fdb346273aa74
SSDEEP 12288:yVFR6dYKVC9eym65QBZ8C89iIdw5mRGv3YZtF15kjH+A:UREC9eym65EKCwi6KmRq3AA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

yasno stealc

Malware Config

Extracted

Family

stealc

Botnet

Yasno

C2

http://45.93.20.61

Attributes

url_path
/0462fab2d67b49d5.php

rc4.plain

Signatures

Stealc family
stealc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f59e3d31c17a80eec1db5396e2201db.exe

File Explorer

1f59e3d31c17a80eec1db5396e2201db.exe

.exe 735KB

1f59e3d31c17a80eec1db5396e2201db.exe

IMPHASH baedab261d9b0ee2285b2ff329a5eaec
SHA256 48cdd76bee9557da7d9100caa6bf151a3efec0e32f4cbcd3ab14fcf5311715d4
MD5 1f59e3d31c17a80eec1db5396e2201db
SHA1 d27c7b06b1dd7a79e52cc87b50aea5741ef91cc8
SHA512 5d7c82cc594fa41ae4a78a3db63117d6bfec7fa36ae03ef99a86b38be50d2f4b9872c92eae7302dd62d13c5e9bd6bed5078c6e3d0876785caa2fdb346273aa74
SSDEEP 12288:yVFR6dYKVC9eym65QBZ8C89iIdw5mRGv3YZtF15kjH+A:UREC9eym65EKCwi6KmRq3AA
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

262204

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleFileNameA LoadLibraryA GetProcAddress GetCurrentProcess SetEndOfFile QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId MultiByteToWideChar GetStringTypeW GetLocaleInfoEx WideCharToMultiByte InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess WriteFile HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode CloseHandle FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize RtlUnwind

Name

.text

Size

434KB

Virtual Size

436KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

177KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

1f59e3d31c17a80eec1db5396e2201db.exe

kernel32

generic