stealc | 354d3dc2b8997764925d5c42ee1c87acb4ba0bdca257edb7a2e63f53a4678c5c[.]bin

General

Target
354d3dc2b8997764925d5c42ee1c87acb4ba0bdca257edb7a2e63f53a4678c5c.bin
Size 625KB
Sample260716-envwcsf14v
SHA256 354d3dc2b8997764925d5c42ee1c87acb4ba0bdca257edb7a2e63f53a4678c5c
MD5 c5301a1371c5be265ed62c10dc87e23d
SHA1 a705003e5b1dff40451b6a87ca1d3de27491d0fe
SHA512 69b1976f1fb11df7f61dcc0c3e3b2aea03b83694aed7d2f323beaabad8bda682263e34dfc0d8541b0a40d6796166860283b89588ad98ae520f37c73647853bfe
SSDEEP 12288:ZUoVNdZJ9HO5ov7LJb7B4abh+1uyxBlDetAqxSvwiA:ZUIvcojLJqa1+1uyb4i
TLSH
T1F2D4C013B9A19076E1724635CD78AB549B7DBC700F20A7CB67C005AA6EB06C0AF37767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer stealc

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 2 1 IoCs

resource	yara_rule
sample	family_stealc_v2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
354d3dc2b8997764925d5c42ee1c87acb4ba0bdca257edb7a2e63f53a4678c5c.bin

File Explorer

354d3dc2b8997764925d5c42ee1c87acb4ba0bdca257edb7a2e63f53a4678c5c.bin

.exe 625KB

354d3dc2b8997764925d5c42ee1c87acb4ba0bdca257edb7a2e63f53a4678c5c.bin

IMPHASH cd702dbfbd74cf5a80f59195b2460134
SHA256 354d3dc2b8997764925d5c42ee1c87acb4ba0bdca257edb7a2e63f53a4678c5c
MD5 c5301a1371c5be265ed62c10dc87e23d
SHA1 a705003e5b1dff40451b6a87ca1d3de27491d0fe
SHA512 69b1976f1fb11df7f61dcc0c3e3b2aea03b83694aed7d2f323beaabad8bda682263e34dfc0d8541b0a40d6796166860283b89588ad98ae520f37c73647853bfe
SSDEEP 12288:ZUoVNdZJ9HO5ov7LJb7B4abh+1uyxBlDetAqxSvwiA:ZUIvcojLJqa1+1uyb4i
TLSH
T1F2D4C013B9A19076E1724635CD78AB549B7DBC700F20A7CB67C005AA6EB06C0AF37767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects Stealc stealer Version 2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

124515

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA GetProcAddress GetCurrentProcess HeapSize QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime Sleep GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetLocaleInfoEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo IsProcessorFeaturePresent SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RaiseException RtlUnwind GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess TerminateProcess FreeLibrary WriteFile IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode CloseHandle VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW SetEndOfFile

Sharing