UnixStealerV2.7z
- SHA256 896bfc9a73b587c531367d9416b4f49736d6ed47f174976782c534eb1838c2f6
Password
infected
Overview
overview
8Static
static
3UnixSteale...er.exe
windows10-2004-x64
1UnixSteale...er.exe
windows11-ltsc_2024-x64
8UnixSteale...er.exe
windows10-2004-x64
1UnixSteale...er.exe
windows11-ltsc_2024-x64
8UnixSteale...db.dll
windows10-2004-x64
1UnixSteale...db.dll
windows11-ltsc_2024-x64
1UnixSteale...db.dll
windows10-2004-x64
1UnixSteale...db.dll
windows11-ltsc_2024-x64
1UnixSteale...ks.dll
windows10-2004-x64
1UnixSteale...ks.dll
windows11-ltsc_2024-x64
1UnixSteale...il.dll
windows10-2004-x64
1UnixSteale...il.dll
windows11-ltsc_2024-x64
1UnixSteale...le.dll
windows10-2004-x64
1UnixSteale...le.dll
windows11-ltsc_2024-x64
1UnixSteale...ub.exe
windows10-2004-x64
7UnixSteale...ub.exe
windows11-ltsc_2024-x64
8Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
UnixStealerV2/Builder.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
UnixStealerV2/Builder.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral3
Sample
UnixStealerV2/Builder.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
UnixStealerV2/Builder.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
34 signatures
900 seconds
Behavioral task
behavioral5
Sample
UnixStealerV2/Mono.Cecil.Mdb.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
UnixStealerV2/Mono.Cecil.Mdb.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
UnixStealerV2/Mono.Cecil.Pdb.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
UnixStealerV2/Mono.Cecil.Pdb.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
UnixStealerV2/Mono.Cecil.Rocks.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
UnixStealerV2/Mono.Cecil.Rocks.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
UnixStealerV2/Mono.Cecil.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
UnixStealerV2/Mono.Cecil.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
UnixStealerV2/Spectre.Console.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
UnixStealerV2/Spectre.Console.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
UnixStealerV2/Stub/stub.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
900 seconds
Behavioral task
behavioral16
Sample
UnixStealerV2/Stub/stub.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
900 seconds
General
- Target UnixStealerV2.7z
- Size 604KB
- Sample260908-tsykdathrf
- SHA256 896bfc9a73b587c531367d9416b4f49736d6ed47f174976782c534eb1838c2f6
- MD5 40ef1735541baa34b1b1501f8b7c1ed7
- SHA1 63844bc00c5431384954f8ff5911d3a2bee1356a
- SHA512 8cc9eeff13cdfde66eb9222c11cc61b9611536e20a87bf7973729ebea8334d6cb1c6431cf94f6b86afda1f49f18e2169a0250097b035cf84e21a4f56035cf645
- SSDEEP 12288:HSfVKMohzuYLB4GbjcDT1Cm6c92pV5pi4wx8e4Ts3U41mK63F5vO5eX283z:HDzzVLCGb5I9Obpi4u8eKskMk/vo8z
- TLSH T150D4239C86A206FB3F0FA32B9408A754189F845341659E78E0197FDD7DC2F849EDCE86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/UnixStealerV2/Builder.dll unpack001/UnixStealerV2/Builder.exe unpack001/UnixStealerV2/Mono.Cecil.Mdb.dll unpack001/UnixStealerV2/Mono.Cecil.Pdb.dll unpack001/UnixStealerV2/Mono.Cecil.Rocks.dll unpack001/UnixStealerV2/Mono.Cecil.dll unpack001/UnixStealerV2/Spectre.Console.dll unpack001/UnixStealerV2/Stub/stub.exe
File Explorer
-
UnixStealerV2.7z.7z 604KB
-
UnixStealerV2/Builder.dll.exe 31KB
-
UnixStealerV2/Builder.exe.exe 147KB
-
UnixStealerV2/Builder.runtimeconfig.json372B
-
UnixStealerV2/Mono.Cecil.Mdb.dll.dll 38KB
-
UnixStealerV2/Mono.Cecil.Pdb.dll.dll 87KB
-
UnixStealerV2/Mono.Cecil.Rocks.dll.dll 24KB
-
UnixStealerV2/Mono.Cecil.dll.dll 348KB
-
UnixStealerV2/Spectre.Console.dll.dll 794KB
-
UnixStealerV2/Stub/stub.exe.exe 258KB
UnixStealerV2/Builder.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3ba937c60ebb6a47149f3f17ed26f8d7926f51c4fd665be7af5c1b6bcfbf44a3
- MD5 cefc8e17a678f07e1fec33c1c92afe36
- SHA1 aefde8a313348e876a47da0881c24e09306a3e9f
- SHA512 8009ac41ce7e4c6ca7e7e3ff5515c9ff9cbcb0a973fa44a2d49ccfc8c51a7c42f77550ebeb0d3edd23cf859c43e04f139cc078d282591eaafe62b7463cfb2141
- SSDEEP 768:PuCA0HcjIq+7pwDIcq+GVWOuPBNjR9dlJ8U:PfA0HcjIq+7pqqRVB0TR9TqU
- TLSH T121E2180177F84A27E27E87B42BF1924907F3F5661162CBDD2DDA70DA40E2B604621F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
37122
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\brtig\OneDrive\Desktop\Src\! UnixStealer\Builder\obj\Release\net6.0-windows\Builder.pdb
mscoree
_CorExeMain
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UnixStealerV2/Builder.exe
- IMPHASH a8308de57fce070f4cb88c7f43bf4b27
- SHA256 8158bbcd71f29aed2855c6ee6f3e48239e4e2c78739bfd10d441a6d18f11fd40
- MD5 f2dfb8bdf2c71e609fe3b08e947fe439
- SHA1 18bb013f1cd3ea22f3366bc94f4a3704b4a06447
- SHA512 4bbc32a95f31b3cec7b0b6b8aeaa88965159ea98cd448ac45c1bd70a6383ed5ae13443889dce537a15c8b768da1af712cdfdbccb3f6835539d0f52a374517ca8
- SSDEEP 3072:t5vnr5Tbx829UOeKnn2LFzZBp13u36wKp4zULCgoC:tBKjK2LFzZNfIULl
- TLSH T1CBE3280772AD11E8D1BBE23D89A24902F7B63826473597DF1350427A0F777E0AEB9721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
82000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
MultiByteToWideChar
GetLastError
GetFileAttributesExW
GetFullPathNameW
GetProcAddress
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EnterCriticalSection
FindFirstFileExW
OutputDebugStringW
LoadLibraryA
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___wargv
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_errno
_configure_wide_argv
_invalid_parameter_noinfo_noreturn
_set_app_type
_seh_filter_exe
_c_exit
exit
_cexit
_register_thread_local_exe_atexit_callback
_crt_atexit
_exit
_initterm_e
abort
_register_onexit_function
_initialize_onexit_table
terminate
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vsprintf_s
setvbuf
_wfopen
_set_fmode
__stdio_common_vswprintf
__acrt_iob_func
fputwc
fputws
__stdio_common_vfwprintf
fflush
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
free
malloc
calloc
api-ms-win-crt-string-l1-1-0
wcsnlen
strcpy_s
_wcsdup
strcspn
wcsncmp
toupper
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-locale-l1-1-0
__pctype_func
_unlock_locales
localeconv
_lock_locales
___lc_codepage_func
___mb_cur_max_func
_configthreadlocale
setlocale
___lc_locale_name_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
frexp
api-ms-win-crt-time-l1-1-0
_gmtime64_s
wcsftime
_time64
Name
.text
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=30034,
count=10, id=259, version=30034,
count=83, id=261, version=30034,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=29395,
count=205, id=1, productName=Unmarked objects,
count=10, id=265, version=30154,
count=1, id=258, version=30154,
UnixStealerV2/Builder.runtimeconfig.json
- SHA256 1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
- MD5 d94cf983fba9ab1bb8a6cb3ad4a48f50
- SHA1 04855d8b7a76b7ec74633043ef9986d4500ca63c
- SHA512 09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998
- TLSH T1CEE02C7BCA10ACB315F52BBAC02AC282FE20232B00004D2A35FC180C2F3AAB30012F49
- MD5 SHA1 SHA512 TLSH
UnixStealerV2/Mono.Cecil.Mdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 61637f9940e5e336571cbf945be0f36d6d6050e06288df0f0232d93b26f0bde7
- MD5 0c4ec4eb146bfe047755669c8060a967
- SHA1 f663cc3bc174a98a49893e0cf334b479b05e453d
- SHA512 478dba76de5b20906a31f2ff72a559779a262abe0265d475aa60d555d4f94f79887f237f393f256134be758d565aa46b30a39e81b23e1f3048fc80ab779405af
- SSDEEP 768:WrF3HuZyOt78PeWSTlNeyJOgfGNOV/DVxPVxaCCrHpTFuYL4oWp:WrFecOt78PeWCLOgfGkVzmpTDL4oWp
- TLSH T1FA0307087BAD962BC2AE56FEE4A126191BF1D53C6603FBAB4DC4B0F3BC437444112267
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
45122
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\symbols\mdb\obj\Release\netstandard2.0\Mono.Cecil.Mdb.pdb
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UnixStealerV2/Mono.Cecil.Pdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a5249a04ad8fd7dfd47e4d0a620aed0f7eb6051e1ddec102c541ca3e12f6e2a8
- MD5 743102d277a8754dc74f7644e03a8956
- SHA1 31971747d45f995bc8d05c26c728df293a074db6
- SHA512 00bb76043a3a147b570e0421f768a2f2238954922c45c611d10d8fd4a1f8ba56da8a7b7377facfe54ff6dbee2d81be87c0d6e3de9e884625697ae478a82677e9
- SSDEEP 1536:QOTXdiVgzDKG2fNRck9FRcXRHr5vMALYKXNgJGsZ9ajr1vjCXev:TT0W2fjvm9uArWJGca31veXev
- TLSH T111937E29ABECA666E4DC72B724A709084BF0E165D143D71D9AC47EFC2C5BB121923393
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
94974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\symbols\pdb\obj\Release\netstandard2.0\Mono.Cecil.Pdb.pdb
mscoree
_CorDllMain
Name
.text
Size
85KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UnixStealerV2/Mono.Cecil.Rocks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 273292babd45f9f34de5054bd9cdfe1d859a7dbf6f4ad5974fe4ead70698ed5b
- MD5 fe8c2b2eef6e5e7284dc9b522a7be468
- SHA1 8779911266ea9bfea924aad33a7e1c7855f41857
- SHA512 b78f759568fa5ce77f87db6f02688493877ced8c9b289934c6adc95db5581d3ebc858092c650a47d5d7eb44c2dd2ed01a8491930acd8173d45f777285d0990ab
- SSDEEP 384:aWLOZBsQXmnFlPQnqc9H559krjuVXcVXD9PmROMLUBLMWG1UX8JvbrjEZ1O/pl+1:5aQHP+qcbkrjuROoUBBLXA/AS
- TLSH T177B239103B99CF3BD2FF867958D2532802B1C96A5603EB064DCC90EA9A5BF945341BF2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
30670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\rocks\obj\Release\netstandard2.0\Mono.Cecil.Rocks.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UnixStealerV2/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 769a59793d4b8885bbbfbc5aee8f57a0d4e34d275c56c60c03994309b87f67e9
- MD5 7c40214d60b54749a1a7f79ea6f62bac
- SHA1 a240d705b52fb1a78cceedab268db42cbeb47512
- SHA512 66a489988d15f1c651061656703b6fb03c4c6ebe82bcb0d48246c760e3764e4a7f2ad8d1653c90401fba6aa9974586d36256ad3a47e1112c1f38488a8818ab92
- SSDEEP 6144:NimznQ2nMpRAX2diEIn5o4gcuomZSFrIb:XnB2EELcu0Fr
- TLSH T1C6747D3527EC873BE69E537FE46A081A82F5D816738BEB8D18C8E9F51C43B5359011A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
360770
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\obj\Release\netstandard2.0\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
346KB
Virtual Size
346KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UnixStealerV2/Spectre.Console.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 842fd97e58fbbac48ccdda0e575b14a1b8af75c42ef87911fddfeda5b7bdbbc5
- MD5 2a47203be983f3dac02c9df64550a25d
- SHA1 d728230fe3cbb43b5cab7ddb6e018ec22955e766
- SHA512 89e969397a32e743b34037998435b16cfa35475ea1898ba495a3e9cfa33022fd6482678d497a962362fd0203d454893b53fa0cdebce44a0c6ccea538b3c02c35
- SSDEEP 12288:KbiZiRA2wChnq791r++f7lWv+YnPXNKCiQGCniCUzSN:XZklnm911CPdKCiQ9nN
- TLSH T18E057C2633E487A7F1ED8A34D8B9261055F1A99A5211DE4FADC858CA1FF3741FC01BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
781102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Spectre.Console.pdb
mscoree
_CorDllMain
Name
.text
Size
792KB
Virtual Size
791KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UnixStealerV2/Stub/stub.exe
- SHA256 59b20774e811849ca7a4f333045604e1517b72a0b47373a7328422c84012c03e
- MD5 48abcd1cfeef155b40f7f0930ac9f779
- SHA1 9939b8f80b4ceea31b4466930fcbcd7c4a1683e0
- SHA512 8ef27cf51a1a89d4529286e14cfcb6e1e1a4b4521af6545baba032cba395bbe4d3d51fb54a8565f9ca93f844ac15e5e9edadc6a9cb3120e665362e94f0079bf7
- SSDEEP 3072:3XQrUaL0q+r9Eq9nhxdfRIUBAfqwcU9JX6/u3Quo5tUCw1kNXztO/QJkhapKJIdn:CknlfptwlF+wOzxJ4a5uRvLrKYzIFPv
- TLSH T17C443A6833F94A15F3BF8B71A8B094914676F82AAD1AE74C1D8524DC2F32750EE11B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\brtig\OneDrive\Desktop\Src\! UnixStealer\Builder\Stub\obj\Release\net48\UnixStealerV2.pdb
Name
.text
Size
252KB
Virtual Size
251KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ