stealc | 7cdfcc7b5915cb89524d89a36487d3f3f905b619dd91304d1a50790eb16b4908[.]exe

General

Target
7cdfcc7b5915cb89524d89a36487d3f3f905b619dd91304d1a50790eb16b4908.exe
Size 767KB
Sample260604-sv1bbahx21
SHA256 7cdfcc7b5915cb89524d89a36487d3f3f905b619dd91304d1a50790eb16b4908
MD5 365205a89bd2f125914d4af39d83256d
SHA1 f788ba850045acd666c8fb42188a1f9b7346e3e2
SHA512 3badef64bbb68330cd281729f87de6c84497ce3ea22aefe04a52fba34b8347a2c423da849255ec2058f1c1b23b5f6b38087e2bcdac8c32936a2e6e96d03385f3
SSDEEP 12288:cAXUMRGu4T4r7O6a9fiCHYuyxBlDetAqxSv+8:cEUPu4qy6kqmYuybX
TLSH
T1E7F49E1AF3A512FCD1BBC274CA524553EB72B8565330A69F03E14A661F336A05F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

22x05x2026 stealer stealc

Malware Config

Extracted

Family

stealc

Botnet

22x05x2026

C2

http://196.251.107.130/16b022998f754137b60a.php

Attributes

url_path
/16b022998f754137b60a.php

rc4.traffic_key

rc4.plain

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7cdfcc7b5915cb89524d89a36487d3f3f905b619dd91304d1a50790eb16b4908.exe

File Explorer

7cdfcc7b5915cb89524d89a36487d3f3f905b619dd91304d1a50790eb16b4908.exe

.exe 767KB

7cdfcc7b5915cb89524d89a36487d3f3f905b619dd91304d1a50790eb16b4908.exe

IMPHASH 87147560825b2f787461d71a5c046839
SHA256 7cdfcc7b5915cb89524d89a36487d3f3f905b619dd91304d1a50790eb16b4908
MD5 365205a89bd2f125914d4af39d83256d
SHA1 f788ba850045acd666c8fb42188a1f9b7346e3e2
SHA512 3badef64bbb68330cd281729f87de6c84497ce3ea22aefe04a52fba34b8347a2c423da849255ec2058f1c1b23b5f6b38087e2bcdac8c32936a2e6e96d03385f3
SSDEEP 12288:cAXUMRGu4T4r7O6a9fiCHYuyxBlDetAqxSv+8:cEUPu4qy6kqmYuybX
TLSH
T1E7F49E1AF3A512FCD1BBC274CA524553EB72B8565330A69F03E14A661F336A05F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

293624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle LoadLibraryA GetProcAddress GetCurrentProcess SetEndOfFile QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetLocaleInfoEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess TerminateProcess FreeLibrary WriteFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize RtlUnwind

Name

.text

Size

462KB

Virtual Size

462KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

177KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

7cdfcc7b5915cb89524d89a36487d3f3f905b619dd91304d1a50790eb16b4908.exe

kernel32

generic