General

  • Target
    tmpx8umcgiv
  • Size 12.3MB
  • Sample260518-2egcyadw21
  • SHA256 d23e806f40d871f50534379a91572d06d55b946cc789cebc38f63d9a7b43f631
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • metastealer

C2
  • iqowocguasswcmca.xyz

  • kgeyscaqeacwaccu.xyz

  • ugmkmoigiimgmaaw.xyz

  • kmiigggyqiwkeeci.xyz

  • scqekwyoswaguuyo.xyz

  • skssoeqouussusyi.xyz

  • uamgayumeqmwemas.xyz

  • sqoqemcwacmqskeu.xyz

  • ocuguoiskuiwmseq.xyz

  • mkgmamqgamaeekom.xyz

  • yceiuagwqygyuqew.xyz

  • meoaqgiscackkuai.xyz

  • oioyigmogeyekogg.xyz

  • ocewemyqacwyyoyi.xyz

  • icewquouagkgwyga.xyz

  • mqmqegyoaoqwcgmy.xyz

  • gmisaugieuauawci.xyz

  • ammiocqyocyquuqe.xyz

  • geicewuqwiyeiuwg.xyz

  • scaukkkccwgwmsss.xyz

Attributes
  • dga_seed

    4411

  • domain_length

    16

  • num_dga_domains

    10000

  • port

    1775

Signatures

  • Family: Meta Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

  • MetaStealer payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • tmpx8umcgiv
    .dll 12.3MB

tmpx8umcgiv

  • IMPHASH 3eda54b3a97faf0e4f8a2c8bdea0cc05
  • SHA256 d23e806f40d871f50534379a91572d06d55b946cc789cebc38f63d9a7b43f631
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • MetaStealer payload

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
6
Entry point
4085802
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL
PDB paths