stealc | x23695936e268c7ff65d8a0e691f732ee784e7959ac3271824f566d7411538fd7[.]exe

General

Target
x23695936e268c7ff65d8a0e691f732ee784e7959ac3271824f566d7411538fd7.exe
Size 761KB
Sample260418-mkbbjscy4k
SHA256 23695936e268c7ff65d8a0e691f732ee784e7959ac3271824f566d7411538fd7
MD5 0d519b783bbbe9691cef57f767c68262
SHA1 e77ffb7c5213c1e744a6bd38a14a87500c849a75
SHA512 265aa051d329c42f6f34107e60386e42663b1fdcc252e33d9b306ea39f7700a218fe8fa4d64947790f01cc5399bcd1383e7221c84b1d0bfb2ce2f7aed1512a46
SSDEEP 12288:szvOznjd7Dkqya3OJXJyZzNP8GTop8mUw8yxBlDetAqxSva:VXOqyzJXIPkEWRUjybS
TLSH
T195F48C1BE7A602F9D1B7C274CA424957E772B8065370978F03E14AA61F376909F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

s8tghsr3basrth4 stealer stealc

Malware Config

Extracted

Family

stealc

Botnet

S8tghsr3basrth4

C2

http://158.94.209.253

Attributes

url_path
/33a61823e3c44bfebabf.php

rc4.traffic_key

rc4.C2

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 2 1 IoCs

resource	yara_rule
sample	family_stealc_v2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
x23695936e268c7ff65d8a0e691f732ee784e7959ac3271824f566d7411538fd7.exe

File Explorer

x23695936e268c7ff65d8a0e691f732ee784e7959ac3271824f566d7411538fd7.exe

.exe 761KB

x23695936e268c7ff65d8a0e691f732ee784e7959ac3271824f566d7411538fd7.exe

IMPHASH f456face36cfa724bf01290dd8927512
SHA256 23695936e268c7ff65d8a0e691f732ee784e7959ac3271824f566d7411538fd7
MD5 0d519b783bbbe9691cef57f767c68262
SHA1 e77ffb7c5213c1e744a6bd38a14a87500c849a75
SHA512 265aa051d329c42f6f34107e60386e42663b1fdcc252e33d9b306ea39f7700a218fe8fa4d64947790f01cc5399bcd1383e7221c84b1d0bfb2ce2f7aed1512a46
SSDEEP 12288:szvOznjd7Dkqya3OJXJyZzNP8GTop8mUw8yxBlDetAqxSva:VXOqyzJXIPkEWRUjybS
TLSH
T195F48C1BE7A602F9D1B7C274CA424957E772B8065370978F03E14AA61F376909F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Stealc stealer Version 2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

286128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcess SetEndOfFile GetProcAddress LoadLibraryA GetModuleFileNameA HeapSize CreateFileW QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetLocaleInfoEx InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess WriteFile HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode CloseHandle FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle RtlUnwind

advapi32

RegEnumKeyExA

shlwapi

StrChrA

Name

.text

Size

457KB

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

106KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

177KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

x23695936e268c7ff65d8a0e691f732ee784e7959ac3271824f566d7411538fd7.exe

kernel32

advapi32

shlwapi

generic