stealc | x4e330342b5f5050bcda28cef53c3cae669ed8dce5a4c[.]exe

General

Target
x4e330342b5f5050bcda28cef53c3cae669ed8dce5a4c.exe
Size 741KB
Sample260205-mgl9msd19c
SHA256 4e330342b5f5050bcda28cef53c3cae669ed8dce5a4c7815b4c2d79e9ad091b2
MD5 8186eaf06f47d78af7ab8082ab64b3ce
SHA1 88816f54af72f1ffab473a57202cc92a813de5f3
SHA512 a01b08c5a25015e94ed1f52573a6f1959c6227857d3f974814320eea4dc424e30f7dddee00c8d3af181d0af54fe06b5a71811ede78f254306391882c85c37278
SSDEEP 12288:MU8VHX4ZPBuvzkOkW7UE+YTRqwJ4iQti6ALSQTbAK4lVA4:GVH6BuvbkW7xXVVm1izQA4
TLSH
T142F48D5AE7A602F9D0BBC178CE424553E7B2B8155370978F03E15AA61F372A05F3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

v6 stealc

Malware Config

Extracted

Family

stealc

Botnet

v6

C2

http://103.101.85.39

Attributes

url_path
/e57fc20ec405486a.php

rc4.plain

Signatures

Stealc family
stealc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
x4e330342b5f5050bcda28cef53c3cae669ed8dce5a4c.exe

File Explorer

x4e330342b5f5050bcda28cef53c3cae669ed8dce5a4c.exe

.exe 741KB

x4e330342b5f5050bcda28cef53c3cae669ed8dce5a4c.exe

IMPHASH baedab261d9b0ee2285b2ff329a5eaec
SHA256 4e330342b5f5050bcda28cef53c3cae669ed8dce5a4c7815b4c2d79e9ad091b2
MD5 8186eaf06f47d78af7ab8082ab64b3ce
SHA1 88816f54af72f1ffab473a57202cc92a813de5f3
SHA512 a01b08c5a25015e94ed1f52573a6f1959c6227857d3f974814320eea4dc424e30f7dddee00c8d3af181d0af54fe06b5a71811ede78f254306391882c85c37278
SSDEEP 12288:MU8VHX4ZPBuvzkOkW7UE+YTRqwJ4iQti6ALSQTbAK4lVA4:GVH6BuvbkW7xXVVm1izQA4
TLSH
T142F48D5AE7A602F9D0BBC178CE424553E7B2B8155370978F03E15AA61F372A05F3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

262348

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleFileNameA LoadLibraryA GetProcAddress GetCurrentProcess SetEndOfFile QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId MultiByteToWideChar GetStringTypeW GetLocaleInfoEx WideCharToMultiByte InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess WriteFile HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode CloseHandle FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize RtlUnwind

Name

.text

Size

434KB

Virtual Size

433KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

177KB

Virtual Size

247KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

detglw

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

x4e330342b5f5050bcda28cef53c3cae669ed8dce5a4c.exe

kernel32

generic