stealer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
stealer.exe
Size 175KB
Sample260801-br81lsbe23
SHA256 b55ed6b16561b9e453442063ab68211ceadb4ca0465c5913f4719d7e4d699545
MD5 c1e483517a4b5dfd9b99c869b75d1202
SHA1 9206bd534cfc73b221d8f53ff0756d6b66ac0af3
SHA512 94c7fefe1db9a612b2686fcc3e035ae35ac739a8f8aa4baec0c846695d446f13623f1ec984f8a1ec5e3da78c7326241ea48de1614fff67b4ef861b6a94d27d15
SSDEEP 3072:uAh3ChJGM9y31aGlNgLFZBfD7WRUErTKdXkNGSm:uFhJGM9y31DNgLLnS2Z
TLSH
T168047C56B3A910F9E0678238C9914A06F77274224770AFEF43A44776EF236D1AD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
stealer.exe

File Explorer

stealer.exe

.exe 175KB

stealer.exe

IMPHASH 9cd000649d097b4f7b69952e1eab49a9
SHA256 b55ed6b16561b9e453442063ab68211ceadb4ca0465c5913f4719d7e4d699545
MD5 c1e483517a4b5dfd9b99c869b75d1202
SHA1 9206bd534cfc73b221d8f53ff0756d6b66ac0af3
SHA512 94c7fefe1db9a612b2686fcc3e035ae35ac739a8f8aa4baec0c846695d446f13623f1ec984f8a1ec5e3da78c7326241ea48de1614fff67b4ef861b6a94d27d15
SSDEEP 3072:uAh3ChJGM9y31aGlNgLFZBfD7WRUErTKdXkNGSm:uFhJGM9y31DNgLLnS2Z
TLSH
T168047C56B3A910F9E0678238C9914A06F77274224770AFEF43A44776EF236D1AD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptSetProperty BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptCloseAlgorithmProvider

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen WinHttpOpenRequest

shell32

SHGetFolderPathA

ntdll

RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind RtlCaptureContext RtlPcToFileHeader RtlGetVersion

advapi32

OpenProcessToken GetUserNameA RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx

user32

wsprintfA

kernel32

GetProcessHeap LCMapStringW CompareStringW CreateFileW LoadLibraryExW VirtualProtect HeapSize HeapReAlloc SetEndOfFile WriteConsoleW FlushFileBuffers CreateDirectoryA DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA RemoveDirectoryA GetTempPathA CloseHandle OpenProcess GetLocalTime GetProcAddress LoadLibraryA LocalFree lstrcpyA lstrcatA CopyFileA GetComputerNameA MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RaiseException ReadFile DuplicateHandle GetCurrentProcess CreateProcessW GetStdHandle WriteFile GetModuleFileNameW ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx WaitForSingleObject GetExitCodeProcess GetFileAttributesExW CreatePipe FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW

Name

.text

Size

113KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

stealer.exe

crypt32

bcrypt

winhttp

shell32

ntdll

advapi32

user32

kernel32

generic