stealer-module[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
stealer-module.exe
Size 3.0MB
Sample260529-vsazraay21
SHA256 2c40f9fdbfa906c88ccd5fbc42574a3b2baa531a20c01079c31d99104a1eab36
MD5 64c44a7bc35aa58a6ce6719b78b2725a
SHA1 7bf73877401f1632c029dd2a7c1a8784b1ef4a89
SHA512 a98d5062e7ca8fb759f872c4cf87037ae81508897f01a90ced4623a113a62621d72822f2b4dfdfdbd1528fe4568d13b553f2e33f64b616b7529c92e32eb3e9a0
SSDEEP 49152:s/031f0Int4OSWmakTkIM1tcQXymxiSFQYItiuxxmYsGog1:n3q5OS3a9pkicmYVx
TLSH
T131E58C43F29981ECC09EC178C71A9227EBB2B88A1630A79F57E44B613F67E611F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
stealer-module.exe

File Explorer

stealer-module.exe

.exe 3.0MB

stealer-module.exe

IMPHASH d3dd750a16098d5f0a87382b247697e8
SHA256 2c40f9fdbfa906c88ccd5fbc42574a3b2baa531a20c01079c31d99104a1eab36
MD5 64c44a7bc35aa58a6ce6719b78b2725a
SHA1 7bf73877401f1632c029dd2a7c1a8784b1ef4a89
SHA512 a98d5062e7ca8fb759f872c4cf87037ae81508897f01a90ced4623a113a62621d72822f2b4dfdfdbd1528fe4568d13b553f2e33f64b616b7529c92e32eb3e9a0
SSDEEP 49152:s/031f0Int4OSWmakTkIM1tcQXymxiSFQYItiuxxmYsGog1:n3q5OS3a9pkicmYVx
TLSH
T131E58C43F29981ECC09EC178C71A9227EBB2B88A1630A79F57E44B613F67E611F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2412284

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

stealer_module.pdb

crypt32

CryptUnprotectData CertDuplicateCertificateContext CertDuplicateStore CertFreeCertificateContext CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertOpenStore CertCloseStore CertEnumCertificatesInStore CertDuplicateCertificateChain CertAddCertificateContextToStore

kernel32

SetFileInformationByHandle SetFileTime FindFirstFileExW SetHandleInformation CreateThread GetTickCount GetFullPathNameW GetSystemInfo FindNextFileW WriteConsoleW GetSystemTimePreciseAsFileTime WaitForSingleObject GetConsoleOutputCP FreeLibrary GetConsoleMode GetStdHandle SetEnvironmentVariableW ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess LoadLibraryA WaitForSingleObjectEx GetCurrentThreadId FindClose GetCurrentThread GetModuleHandleW CreateFileW LocalFree GetModuleHandleA Sleep AddVectoredExceptionHandler CancelIoEx SetFileCompletionNotificationModes lstrlenW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WideCharToMultiByte MultiByteToWideChar GetEnvironmentVariableW QueryPerformanceFrequency GetFileInformationByHandleEx FlushFileBuffers MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection CreateIoCompletionPort QueryPerformanceCounter SetThreadStackGuarantee LoadLibraryExW SetThreadErrorMode GetProcAddress GetQueuedCompletionStatusEx GetFinalPathNameByHandleW IsProcessorFeaturePresent LoadLibraryExA FormatMessageW GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead HeapAlloc SetLastError ReadFile PostQueuedCompletionStatus WriteFile GetOverlappedResult TerminateProcess HeapFree GetProcessHeap CloseHandle SwitchToThread HeapReAlloc GetFileInformationByHandle SetFilePointerEx IsDebuggerPresent

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

oleaut32

SysStringLen SysFreeString GetErrorInfo

bcryptprimitives

ProcessPrng

ws2_32

recv WSASocketW bind getsockopt closesocket WSAStartup WSAIoctl connect shutdown WSASend setsockopt getsockname WSAGetLastError getpeername WSACleanup getaddrinfo freeaddrinfo send ioctlsocket

ntdll

NtCancelIoFileEx NtReadFile RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtWriteFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

secur32

ApplyControlToken DeleteSecurityContext EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW QueryContextAttributesW AcquireCredentialsHandleA DecryptMessage FreeCredentialsHandle

user32

GetMonitorInfoW EnumDisplaySettingsExW GetSystemMetrics EnumDisplayMonitors

gdi32

CreateCompatibleDC DeleteDC GetDeviceCaps CreateDCW CreateCompatibleBitmap DeleteObject GetObjectW SetStretchBltMode StretchBlt GetDIBits SelectObject

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

vcruntime140

memcmp __CxxFrameHandler3 memcpy memset memmove memchr strchr __current_exception_context strrchr __current_exception __C_specific_handler

api-ms-win-crt-math-l1-1-0

log2 fabs __setusermatherr fmin pow _dclass round log roundf

api-ms-win-crt-string-l1-1-0

strcmp strcspn strlen strncmp strspn

api-ms-win-crt-heap-l1-1-0

_msize free _set_new_mode malloc realloc

api-ms-win-crt-utility-l1-1-0

_rotl64 qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_endthreadex _initterm _beginthreadex _cexit _initialize_narrow_environment _set_app_type _get_initial_narrow_environment _initterm_e exit _exit _c_exit _seh_filter_exe terminate _crt_atexit _register_onexit_function _initialize_onexit_table _register_thread_local_exe_atexit_callback __p___argc _configure_narrow_argv __p___argv

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale