751stealer | loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 1.6MB
Sample260629-n9bt2scw21
SHA256 0219224c51d8bb89c231f16bd9993773af87f2fec19776a069e06943f051d717
MD5 0730b4fcad7df2e64f5fe70e67d9d9ab
SHA1 0d29370dfb949637dd2f812f5532a96220d26e0b
SHA512 b2842d53486498fdb426125b909a287253126e968cc642da525f0aef8472e6fd2606b11608be625f59ab62882f4d79261392534384fd91874c42e587d042276e
SSDEEP 49152:lxmWKdEuKOulAvMaHVv/1kBtjUHrF8GB:lxLyKOusMapKB9QF9
TLSH
T1BF85F106A7E114FDC1AFE134CD625502E976FC9747649DBF43E899A12E333808E7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer 751stealer

Malware Config

Extracted

Family

751stealer

https://751.lol

Attributes

owner_id
68fe81e8e2f24a5d

Signatures

Family: 751Stealer
751 Stealer is a Windows infostealer distributed as a .NET 8 single-file bundle that grabs browser data, files, and crypto wallets.
stealer 751stealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 1.6MB

loader.exe

IMPHASH 8d8029e87dbf652ff8d7bb1768ceef69
SHA256 0219224c51d8bb89c231f16bd9993773af87f2fec19776a069e06943f051d717
MD5 0730b4fcad7df2e64f5fe70e67d9d9ab
SHA1 0d29370dfb949637dd2f812f5532a96220d26e0b
SHA512 b2842d53486498fdb426125b909a287253126e968cc642da525f0aef8472e6fd2606b11608be625f59ab62882f4d79261392534384fd91874c42e587d042276e
SSDEEP 49152:lxmWKdEuKOulAvMaHVv/1kBtjUHrF8GB:lxLyKOusMapKB9QF9
TLSH
T1BF85F106A7E114FDC1AFE134CD625502E976FC9747649DBF43E899A12E333808E7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1350212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

advapi32

RegCloseKey RegQueryValueExA GetUserNameA RegOpenKeyExA

user32

ShowWindow MessageBoxW

winhttp

WinHttpSendRequest WinHttpCloseHandle WinHttpConnect WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpWriteData WinHttpReceiveResponse WinHttpSetTimeouts

kernel32

WriteConsoleW SetEndOfFile LeaveCriticalSection HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW SizeofResource GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle GetModuleHandleA Sleep GetTempPathA GetLastError GetFileAttributesA LockResource CloseHandle LoadResource FindResourceW GetConsoleWindow SetConsoleOutputCP GetComputerNameA ExpandEnvironmentStringsW WaitForSingleObject ReadFile SetFilePointer CreateFileW CreateProcessW WriteFile CreateNamedPipeW PeekNamedPipe GetCurrentThreadId GetCurrentProcessId WideCharToMultiByte GetTickCount ConnectNamedPipe GetModuleHandleW LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetTempPathW AreFileApisANSI GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar QueryPerformanceCounter EnterCriticalSection RtlUnwind InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead GetCurrentProcess TerminateProcess VirtualProtect RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

148KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

loader.exe

version

advapi32

user32

winhttp

kernel32

generic