maskgram_stealer | 0976c83ba5a478a2defcd173ddb59d0bf405527c8a944d490a88025f9b999c1c

Sharing

Copy URL Twitter E-mail

General

Target
0976c83ba5a478a2defcd173ddb59d0bf405527c8a944d490a88025f9b999c1c
Size 12.2MB
Sample260809-hlblgswvdy
SHA256 0976c83ba5a478a2defcd173ddb59d0bf405527c8a944d490a88025f9b999c1c
MD5 89f07c2c6d3f82e61ce269961c9c356d
SHA1 a851777dbf9e928814235024a36cfa715a6ca9de
SHA512 3315b406f6cd5a0912f9c27009841f626632125eeb9fc6c28f577d08205aa3fa2babb07a4e39e30f9a7c02d8ef8ef697fdb5a96fb6bee7e5ac4c0711ee60701a
SSDEEP 196608:kpHCKnaJEiwsaB5cxbW2Ru4JEEE3X4n7XXFePob70Eug6yofvlk/H2bT6LUVvEus:AhDiwBcxbEno71sZwofy/WXjlEvv
TLSH
T1CBD6129259CA52F8D0C74B30518752DF70D17AAAC5BEAD0D3AC56C0327B1FAA158FB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer maskgram_stealer

Malware Config

Signatures

Family: MaskGramStealer
MaskGramStealer is an information stealer.
stealer maskgram_stealer

Detects MaskGramStealer payload 1 IoCs

resource	yara_rule
sample	family_maskgramstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0976c83ba5a478a2defcd173ddb59d0bf405527c8a944d490a88025f9b999c1c

File Explorer

0976c83ba5a478a2defcd173ddb59d0bf405527c8a944d490a88025f9b999c1c

.exe 12.2MB

0976c83ba5a478a2defcd173ddb59d0bf405527c8a944d490a88025f9b999c1c

IMPHASH ea281082cd6342019a4640d5d7089aef
SHA256 0976c83ba5a478a2defcd173ddb59d0bf405527c8a944d490a88025f9b999c1c
MD5 89f07c2c6d3f82e61ce269961c9c356d
SHA1 a851777dbf9e928814235024a36cfa715a6ca9de
SHA512 3315b406f6cd5a0912f9c27009841f626632125eeb9fc6c28f577d08205aa3fa2babb07a4e39e30f9a7c02d8ef8ef697fdb5a96fb6bee7e5ac4c0711ee60701a
SSDEEP 196608:kpHCKnaJEiwsaB5cxbW2Ru4JEEE3X4n7XXFePob70Eug6yofvlk/H2bT6LUVvEus:AhDiwBcxbEno71sZwofy/WXjlEvv
TLSH
T1CBD6129259CA52F8D0C74B30518752DF70D17AAAC5BEAD0D3AC56C0327B1FAA158FB23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Detects MaskGramStealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5361784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

102KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

11KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pckd0

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.pckd1

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pckd2

Size

7.8MB

Virtual Size

7.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

264KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

0976c83ba5a478a2defcd173ddb59d0bf405527c8a944d490a88025f9b999c1c

advapi32

kernel32

user32

generic