stealc | xa4f3bed939becb91cb104dc61bcf9e58314de9858b9d[.]exe

General

Target
xa4f3bed939becb91cb104dc61bcf9e58314de9858b9d.exe
Size 37.3MB
Sample260405-e7xjash15p
SHA256 a4f3bed939becb91cb104dc61bcf9e58314de9858b9d07125a3d3312ee40f0cb
MD5 68602c6e88fb1cc63e8c9597694cb557
SHA1 8af765888325a0edc39efd57408ae67e815a8778
SHA512 9fed4e6af4f6fb69fb9255474b0bc6d91b92f55a225b8385ce219b6d5e2d7fd49054fff5fb265c44cd92dd6ddefbc1d8836ff2260f8f99c8d6f054f500f26454
SSDEEP 786432:7ba1Fg1JnlbpfccLBSFopYy0sj8Ew2Ovkmdx7JFO:i1SJlbp0kcoyFs5qhx7JF
TLSH
T10C872336AE5351B8D36BC13584728B11DEF2FC122B218A8B33D4055A5F36A9B5E39F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

installer stealc amadey svcstealer

Malware Config

Signatures

Amadey family
amadey

Detects Stealc stealer Version 2 1 IoCs

resource	yara_rule
sample	family_stealc_v2

Detects SvcStealer aka Diamotrix Clipper Payload 1 IoCs

SvcStealer or Diamotrix Clipper swaps clipboard crypto wallet addresses with the attacker's.

resource	yara_rule
static1/unpack001/zx.pyc	family_svcstealer_3

Stealc family
stealc
Svcstealer family
svcstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xa4f3bed939becb91cb104dc61bcf9e58314de9858b9d.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
sample	innosetup

File Explorer

xa4f3bed939becb91cb104dc61bcf9e58314de9858b9d.exe

.exe 37.3MB
zx.pyc

3KB

xa4f3bed939becb91cb104dc61bcf9e58314de9858b9d.exe

IMPHASH 4029dc5ee830151a426fff64189bae0e
SHA256 a4f3bed939becb91cb104dc61bcf9e58314de9858b9d07125a3d3312ee40f0cb
MD5 68602c6e88fb1cc63e8c9597694cb557
SHA1 8af765888325a0edc39efd57408ae67e815a8778
SHA512 9fed4e6af4f6fb69fb9255474b0bc6d91b92f55a225b8385ce219b6d5e2d7fd49054fff5fb265c44cd92dd6ddefbc1d8836ff2260f8f99c8d6f054f500f26454
SSDEEP 786432:7ba1Fg1JnlbpfccLBSFopYy0sj8Ew2Ovkmdx7JFO:i1SJlbp0kcoyFs5qhx7JF
TLSH
T10C872336AE5351B8D36BC13584728B11DEF2FC122B218A8B33D4055A5F36A9B5E39F13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Stealc stealer Version 2
Unsigned PE

Checks for missing Authenticode signature.
Inno Setup is an open-source installation builder for Windows applications.

Inno Setup installer

installer

Minor OS version

0

Major OS version

6

Entry point

5548

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHGetFolderPathW ShellExecuteW

kernel32

RtlVirtualUnwind WriteConsoleW WriteFile CreateFileW SetFileAttributesW lstrcatW CloseHandle GetCurrentDirectoryW lstrcpyW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Name

.text

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

37.0MB

Virtual Size

37.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

171KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

xa4f3bed939becb91cb104dc61bcf9e58314de9858b9d.exe

shell32

kernel32

generic

zx.pyc