stealc | ecfb9594860fc457c15bd17cbc96d295545130dac23d7bb9170b4bb2c3e23776[.]exe

General

Target
ecfb9594860fc457c15bd17cbc96d295545130dac23d7bb9170b4bb2c3e23776.exe
Size 761KB
Sample260318-ngjdesgz6t
SHA256 ecfb9594860fc457c15bd17cbc96d295545130dac23d7bb9170b4bb2c3e23776
MD5 1966ae9c02c7841010dcf5604cff3019
SHA1 c8cfb45268b2f40d5ad889efd085e5dedc79ba56
SHA512 676b6a36be6a45b42f0522ad71ad7a9832b9b15988bf9ddc24047e359488fadbb6a9fcdad99797c0acb80df6b1bbd83b312881f1f011942c659d14849057cac5
SSDEEP 12288:pzvOznjd7Dkqya3OJXJyZzNP8GTop8m9I8yxBlDetAqxSva:cXOqyzJXIPkEWR9bybS
TLSH
T17AF48D1BE7A502F9D1B7C274CA424957E772B8065370978F03E14AA65F3B2909F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

build002 stealc

Malware Config

Extracted

Family

stealc

Botnet

build002

C2

http://213.176.73.136

Attributes

url_path
/3d9c1a1d0dc9436eb7b7.php

rc4.traffic_key

rc4.C2

Signatures

Detects Stealc stealer Version 2 1 IoCs

resource	yara_rule
sample	family_stealc_v2

Stealc family
stealc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ecfb9594860fc457c15bd17cbc96d295545130dac23d7bb9170b4bb2c3e23776.exe

File Explorer

ecfb9594860fc457c15bd17cbc96d295545130dac23d7bb9170b4bb2c3e23776.exe

.exe 761KB

ecfb9594860fc457c15bd17cbc96d295545130dac23d7bb9170b4bb2c3e23776.exe

IMPHASH f456face36cfa724bf01290dd8927512
SHA256 ecfb9594860fc457c15bd17cbc96d295545130dac23d7bb9170b4bb2c3e23776
MD5 1966ae9c02c7841010dcf5604cff3019
SHA1 c8cfb45268b2f40d5ad889efd085e5dedc79ba56
SHA512 676b6a36be6a45b42f0522ad71ad7a9832b9b15988bf9ddc24047e359488fadbb6a9fcdad99797c0acb80df6b1bbd83b312881f1f011942c659d14849057cac5
SSDEEP 12288:pzvOznjd7Dkqya3OJXJyZzNP8GTop8m9I8yxBlDetAqxSva:cXOqyzJXIPkEWR9bybS
TLSH
T17AF48D1BE7A502F9D1B7C274CA424957E772B8065370978F03E14AA65F3B2909F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Stealc stealer Version 2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

286128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcess SetEndOfFile GetProcAddress LoadLibraryA GetModuleFileNameA HeapSize CreateFileW QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetLocaleInfoEx InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess WriteFile HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode CloseHandle FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle RtlUnwind

advapi32

RegEnumKeyExA

shlwapi

StrChrA

Name

.text

Size

457KB

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

106KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

177KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

ecfb9594860fc457c15bd17cbc96d295545130dac23d7bb9170b4bb2c3e23776.exe

kernel32

advapi32

shlwapi

generic