sirkeira_stealer | e2e4753407066bf1c9ed357d5f0bd563518ef44ca0850997cd3193f8bd3b8b3a[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
e2e4753407066bf1c9ed357d5f0bd563518ef44ca0850997cd3193f8bd3b8b3a.bin
Size 87.3MB
Sample260811-fy3vdsgn21
SHA256 e2e4753407066bf1c9ed357d5f0bd563518ef44ca0850997cd3193f8bd3b8b3a
MD5 d0f6f60d95a0c0cf9313405cb22f917e
SHA1 dc7a7651de8f14439c4c3afab9ee179bcc61ddf4
SHA512 015f336d9ed148ccb601304808bde86b2c6973a060b6847967ef0c57cc0f755acb1cd9a97265ca1cc1f02e8c5e7ddef47b7af1ce60d72854a2d14234fa164ba4
SSDEEP 1572864:dGApZwTIA7Zvr8r0FzbO1JKGEwZvxs/7fFP5OAofSc/JUNn9PhcOXmmXhnAiZEBa:d3pZwZer0FzeHv6TfrifSc/iF9qOXm/c
TLSH
T10E1833059E917889F4AEC6398DE1DF21E1A375ED16838A1B17E00CA02C6B7CED7F4671
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer sirkeira_stealer

Malware Config

Signatures

Family: SirkeiraStealer
Sirkeira Stealer is a stealer written in Python and packaged with PyInstaller.
stealer sirkeira_stealer

Detects Sirkeira Stealer Payload 1 IoCs

resource	yara_rule
static1/unpack001/skstealer.pyc	family_sirkeira_stealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e2e4753407066bf1c9ed357d5f0bd563518ef44ca0850997cd3193f8bd3b8b3a.bin

File Explorer

e2e4753407066bf1c9ed357d5f0bd563518ef44ca0850997cd3193f8bd3b8b3a.bin

.exe 87.3MB
skstealer.pyc

93KB

e2e4753407066bf1c9ed357d5f0bd563518ef44ca0850997cd3193f8bd3b8b3a.bin

SHA256 e2e4753407066bf1c9ed357d5f0bd563518ef44ca0850997cd3193f8bd3b8b3a
MD5 d0f6f60d95a0c0cf9313405cb22f917e
SHA1 dc7a7651de8f14439c4c3afab9ee179bcc61ddf4
SHA512 015f336d9ed148ccb601304808bde86b2c6973a060b6847967ef0c57cc0f755acb1cd9a97265ca1cc1f02e8c5e7ddef47b7af1ce60d72854a2d14234fa164ba4
SSDEEP 1572864:dGApZwTIA7Zvr8r0FzbO1JKGEwZvxs/7fFP5OAofSc/JUNn9PhcOXmmXhnAiZEBa:d3pZwZer0FzeHv6TfrifSc/iF9qOXm/c
TLSH
T10E1833059E917889F4AEC6398DE1DF21E1A375ED16838A1B17E00CA02C6B7CED7F4671
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8396

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1024B

Virtual Size

770B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

87.3MB

Virtual Size

87.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e2e4753407066bf1c9ed357d5f0bd563518ef44ca0850997cd3193f8bd3b8b3a.bin

generic

skstealer.pyc