stealc | 196[.]251[.]107_1[.]23[.]exe

General

Target
196.251.107_1.23.exe
Size 743KB
Sample260106-n4faaa1pew
SHA256 465da9a3f2f36ba40fdf1d7bc998171f470c43bfccb51aab6425dae0ae5c443e
MD5 fbe049590db0ba0a6df6c3235b0cdf59
SHA1 b182074ad15bc7a5d7a761ff941a9d1a6dc13c2e
SHA512 c512fd5fb28c615f8a1ea2da4e5ee12a3d856013e929aa6591aa62062af84bcfe8b3d4cbb32ae73c95d5f359884c16b3e3c45814d6666f23df52aee90c253f6d
SSDEEP 12288:rwVOm41h6aMIChNqge8bNqDVqlPjzad0HkKWv3YZtF15kjHx:r2eMBThN9eiyVqlPjzU0Ez3j
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

iopvb stealc

Malware Config

Extracted

Family

stealc

Botnet

iopvb

C2

http://196.251.107.23

Attributes

url_path
/7ffc7a279c17c091.php

rc4.plain

Signatures

Stealc family
stealc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
196.251.107_1.23.exe

File Explorer

196.251.107_1.23.exe

.exe 743KB

196.251.107_1.23.exe

IMPHASH 112f19f28f55f461c3d7ad7d3898dd7b
SHA256 465da9a3f2f36ba40fdf1d7bc998171f470c43bfccb51aab6425dae0ae5c443e
MD5 fbe049590db0ba0a6df6c3235b0cdf59
SHA1 b182074ad15bc7a5d7a761ff941a9d1a6dc13c2e
SHA512 c512fd5fb28c615f8a1ea2da4e5ee12a3d856013e929aa6591aa62062af84bcfe8b3d4cbb32ae73c95d5f359884c16b3e3c45814d6666f23df52aee90c253f6d
SSDEEP 12288:rwVOm41h6aMIChNqge8bNqDVqlPjzad0HkKWv3YZtF15kjHx:r2eMBThN9eiyVqlPjzU0Ez3j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

264516

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleFileNameA LoadLibraryA GetProcAddress GetCurrentProcess CreateFileW QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId MultiByteToWideChar GetStringTypeW GetLocaleInfoEx WideCharToMultiByte InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess WriteFile HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize CloseHandle

Sharing