vryxen | 813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.zip
Size 4.4MB
Sample260809-sycdnatvbv
SHA256 38454bc8c06812a0226945cbcf3a8f97005f12a2c3f5e9816f71fd751a9fac09
MD5 701e8423abb9f41412a9ec9146148921
SHA1 fe0e7c3fabcaa77ca08c46eb101485b5b503e48c
SHA512 f57dbc893cefb42f4dff42b5cef7ab51fa7833fa051ae0be9bf54ff1718d5f4989dcc29bfede1d3ffb386c13347929113903c569050afea647c8b7b9696a87c9
SSDEEP 98304:0wbGlTdkjDZd99UBCIdGHonuO4Wh75yXyk3gxHoGdfhcVgi:0HTdCd99vHyuO4Wt5KykQxIGpDi
TLSH
T1DC263308168FB783407D542A5A6D9D9F3413588A8400D977D8F96FEB2A3B53F6CACE34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer vryxen

Malware Config

Signatures

Family: Vryxen
Vryxen is an open-source stealer written in Golang.
stealer vryxen

Detects Vryxen stealer 1 IoCs

resource	yara_rule
static1/unpack001/813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae	family_vryxen

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae

File Explorer

813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.zip

.zip 4.4MB
813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae

.exe 10.5MB

813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.zip

SHA256 38454bc8c06812a0226945cbcf3a8f97005f12a2c3f5e9816f71fd751a9fac09
MD5 701e8423abb9f41412a9ec9146148921
SHA1 fe0e7c3fabcaa77ca08c46eb101485b5b503e48c
SHA512 f57dbc893cefb42f4dff42b5cef7ab51fa7833fa051ae0be9bf54ff1718d5f4989dcc29bfede1d3ffb386c13347929113903c569050afea647c8b7b9696a87c9
SSDEEP 98304:0wbGlTdkjDZd99UBCIdGHonuO4Wh75yXyk3gxHoGdfhcVgi:0HTdCd99vHyuO4Wt5KykQxIGpDi
TLSH
T1DC263308168FB783407D542A5A6D9D9F3413588A8400D977D8F96FEB2A3B53F6CACE34
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae
MD5 41e9d226aa36e38baabd337d55f7e8a7
SHA1 269e02fc8d8a5482ecbe5583a23238505682929e
SHA512 10d49cd9124cb53bffc146055836b8cba3f6864b42f3b26045c5cc6b88b68d9f72d6c5b9f2b16dddd1d6906b317979c2cae5a92b0a1dd2800e3ae944c91fb114
SSDEEP 98304:nzJPU3T2z/mhcDHWe2Wo550ZJzzNKsJ10fp790FDEr:n5UDbcD2e2P5+L0h79Lr
TLSH
T1B0B64A47ECA541E9C0ADD5358A669163BA713C884F3423D72F60FB242F76BE0AE79740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Vryxen stealer
Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

507904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

493KB

Virtual Size

856KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.zip

813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae

kernel32

generic