stealc | x090a034eb0469455dca1807940e4576006b349d961c037d38882262dcd758263[.]exe

General

Target
x090a034eb0469455dca1807940e4576006b349d961c037d38882262dcd758263.exe
Size 765KB
Sample260629-eccweadw9l
SHA256 090a034eb0469455dca1807940e4576006b349d961c037d38882262dcd758263
MD5 b377eeb8f053fe87ff192b70372a001f
SHA1 f6180ec8a4966a6c612110a18f7db4d5af0ed3b1
SHA512 cbe4597c00ab8c32e5a8286a2c3e4874b4cedf7abf4b3efa6761888c0f4660aaf56e8429c42be0e8525c3301025dd6aa094d8182c4f52f812490dda83b7b597c
SSDEEP 12288:uPgLoOm0BuwC6ewkMOayYsukksUyxBlDetAqxSv+J/:uoLZgwLrk9adnkkZyb
TLSH
T180F47D1BE3A502F8D0BBC174CA524552EB7278957370A69F03D15B791F33AA06B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

user123cao stealer stealc

Malware Config

Extracted

Family

stealc

Botnet

user123cao

C2

http://64.89.161.67/3b250ef3f9e542adadfb.php

Attributes

url_path
/3b250ef3f9e542adadfb.php

rc4.traffic_key

rc4.plain

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
x090a034eb0469455dca1807940e4576006b349d961c037d38882262dcd758263.exe

File Explorer

x090a034eb0469455dca1807940e4576006b349d961c037d38882262dcd758263.exe

.exe 765KB

x090a034eb0469455dca1807940e4576006b349d961c037d38882262dcd758263.exe

IMPHASH b45095de49856a47334e76102f8e7be0
SHA256 090a034eb0469455dca1807940e4576006b349d961c037d38882262dcd758263
MD5 b377eeb8f053fe87ff192b70372a001f
SHA1 f6180ec8a4966a6c612110a18f7db4d5af0ed3b1
SHA512 cbe4597c00ab8c32e5a8286a2c3e4874b4cedf7abf4b3efa6761888c0f4660aaf56e8429c42be0e8525c3301025dd6aa094d8182c4f52f812490dda83b7b597c
SSDEEP 12288:uPgLoOm0BuwC6ewkMOayYsukksUyxBlDetAqxSv+J/:uoLZgwLrk9adnkkZyb
TLSH
T180F47D1BE3A502F8D0BBC174CA524552EB7278957370A69F03D15B791F33AA06B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

292680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle LoadLibraryA GetProcAddress GetCurrentProcess SetEndOfFile QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetLocaleInfoEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess TerminateProcess FreeLibrary WriteFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize RtlUnwind

Name

.text

Size

461KB

Virtual Size

464KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

106KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

177KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

x090a034eb0469455dca1807940e4576006b349d961c037d38882262dcd758263.exe

kernel32

generic