751stealer | Zero Generator[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Zero Generator.zip
Size 1.4MB
Sample260910-tlv6nsdf85
SHA256 1cad09d76f3f83b82b2cab21c27b9dd3d04f6b89583415993576e8b4b1be9a2b
MD5 2ca26b7407657550b1bc05e7e28ea83f
SHA1 e24fbdfde81f4092c52368f52fd861728b4554a0
SHA512 a974bea53ccf3ff7eb384dc5c6f29b0fde328fe31e87d1a1efe52ac7808463b30619f1b35384e14c398676006f0d853ab3c25916425b8367367d71a2af9e881a
SSDEEP 24576:8EtNg0GmxUwtYV8lAPa1SCGLupzVmBPfjYYDvz0JQkbR85C5OzdQn7LIkncrpIK3:FNgmxBK6ePa1SCGLuZVsYYDvzoXbEmn4
TLSH
T1146533B6B3C477ECF29657591386283202711A43F6A5A222D186E7EECED034B17077B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer 751stealer

Malware Config

Extracted

Family

751stealer

http://stealer.best

Attributes

owner_id
8da0e2f45f6c4e04

Signatures

Family: 751Stealer
751 Stealer is a Windows infostealer distributed as a .NET 8 single-file bundle that grabs browser data, files, and crypto wallets.
stealer 751stealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Zero Generator.exe

File Explorer

Zero Generator.zip

.zip 1.4MB
Zero Generator.exe

.exe 1.8MB

Zero Generator.zip

SHA256 1cad09d76f3f83b82b2cab21c27b9dd3d04f6b89583415993576e8b4b1be9a2b
MD5 2ca26b7407657550b1bc05e7e28ea83f
SHA1 e24fbdfde81f4092c52368f52fd861728b4554a0
SHA512 a974bea53ccf3ff7eb384dc5c6f29b0fde328fe31e87d1a1efe52ac7808463b30619f1b35384e14c398676006f0d853ab3c25916425b8367367d71a2af9e881a
SSDEEP 24576:8EtNg0GmxUwtYV8lAPa1SCGLupzVmBPfjYYDvz0JQkbR85C5OzdQn7LIkncrpIK3:FNgmxBK6ePa1SCGLuZVsYYDvzoXbEmn4
TLSH
T1146533B6B3C477ECF29657591386283202711A43F6A5A222D186E7EECED034B17077B7
MD5 SHA1 SHA512 SSDEEP TLSH

Password

zero900

Zero Generator.exe

IMPHASH adffbde509eacc68e1dba4032b46d38b
SHA256 e995ef48247c9e019d9110e09b6b3c2f8ec9a2ca4982e30a75a55ba29dfd0964
MD5 a7743c9dcafc045c5b4ed78c3a2a634d
SHA1 957343897ceb6656516a4ade4fc0e2af931c3ceb
SHA512 7f3d1c771d1e6521c4c44945fedbcb3d925921b93d48decd8aef7f859a5ab9d5a7ce0a3aae69741d2340734b6eee09bb48197ed18237d5d84b6819a6218029c0
SSDEEP 49152:f/1ufdxsd4Y+rMZrbVtRFb9rmm+GJ0uX:Vuf3s7OM9VNNmmsuX
TLSH
T1CF95E189959000F9C5A3DB78DF7B198AF372B8839B75614733980A925F73360DE2B721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

zero900

Minor OS version

Major OS version

Entry point

1454108

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

shell32

ShellExecuteExA ShellExecuteExW SHGetFolderPathW

advapi32

RegOpenKeyExA RegCreateKeyExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges GetCurrentHwProfileA CredEnumerateW LookupPrivilegeValueA CredFree GetUserNameA RegQueryValueExA RegCloseKey

user32

OpenClipboard CloseDesktop IsWindow GetThreadDesktop SetThreadDesktop GetSystemMetrics keybd_event CloseClipboard DestroyWindow DispatchMessageA GetWindowTextW SetForegroundWindow UpdateWindow GetClientRect TranslateMessage SetLayeredWindowAttributes ExitWindowsEx LockWorkStation MessageBoxA GetDC ShowWindow RegisterClassW DispatchMessageW SetWindowTextW SendMessageW CreateWindowExW FillRect SetWindowRgn SetWindowPos LoadCursorA GetFocus GetKeyState DefWindowProcW GetMessageW GetWindowTextLengthW ReleaseDC GetClipboardData SendMessageA mouse_event CreateDesktopA SwitchDesktop PeekMessageA GetDesktopWindow SystemParametersInfoW SetCursorPos MessageBoxW SendInput OpenInputDesktop

gdiplus

GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdiplusStartup GdipSaveImageToStream GdipCreateBitmapFromScan0

gdi32

CreateFontW GetStockObject CreateRoundRectRgn SetTextColor SetBkColor CreateSolidBrush BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateDIBitmap GetDeviceCaps DeleteDC DeleteObject

ole32

CLSIDFromString GetHGlobalFromStream CreateStreamOnHGlobal

winhttp

WinHttpReadData WinHttpSendRequest WinHttpReceiveResponse WinHttpSetTimeouts WinHttpConnect WinHttpOpenRequest WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpAddRequestHeaders WinHttpOpen WinHttpSetOption

ws2_32

WSASend WSAStartup getaddrinfo socket connect recv freeaddrinfo setsockopt WSAGetLastError WSACleanup closesocket

wlanapi

WlanEnumInterfaces WlanCloseHandle WlanFreeMemory WlanOpenHandle WlanGetProfile WlanGetProfileList

winmm

waveInClose waveInStop waveOutUnprepareHeader waveInAddBuffer waveOutClose waveInGetDevCapsW waveOutReset waveInOpen waveOutOpen waveOutPrepareHeader waveInPrepareHeader waveInStart waveInReset waveInUnprepareHeader waveInGetNumDevs waveOutWrite

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

d3d11

D3D11CreateDevice

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW EnumSystemLocalesW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind WriteConsoleW RtlCaptureContext GetStringTypeW GetCPInfo CompareStringEx DecodePointer EncodePointer HeapReAlloc ReadConsoleW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize SetStdHandle GetProcessHeap FreeLibrary SetEnvironmentVariableW GetSystemTimeAsFileTime InitializeCriticalSectionEx LCMapStringEx WakeAllConditionVariable WakeConditionVariable GetExitCodeThread WaitForSingleObjectEx GetTickCount64 SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency QueryPerformanceCounter MultiByteToWideChar GetFileInformationByHandleEx AreFileApisANSI GetFileAttributesExW FindFirstFileExW GetLocaleInfoEx FormatMessageA LocalFree GlobalUnlock CreateProcessA QueryFullProcessImageNameW SetEndOfFile RtlLookupFunctionEntry GetConsoleWindow CopyFileW GlobalMemoryStatusEx SizeofResource GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle GetModuleFileNameW GetProcessId WaitForSingleObject GetModuleHandleA OpenProcess Sleep GetFileAttributesA LockResource CloseHandle LoadResource FindResourceW RtlUnwind SetConsoleOutputCP GetComputerNameA ExpandEnvironmentStringsW ReadFile SetFilePointer CreateFileW GetLastError CreateProcessW WriteFile CreateNamedPipeW PeekNamedPipe GetCurrentThreadId GetCurrentProcessId WideCharToMultiByte GetTickCount ConnectNamedPipe GetModuleHandleW CreateDirectoryW FindFirstFileW Process32First SetHandleInformation FindFirstFileA EnterCriticalSection FindNextFileW GetCurrentProcess TerminateProcess FindNextFileA LeaveCriticalSection CreatePipe InitializeCriticalSection GetEnvironmentVariableW GetTempPathW FindClose GetFileAttributesW CreateToolhelp32Snapshot Process32NextW GlobalSize DeleteFileW Process32Next Process32FirstW GetSystemInfo GetProcAddress GlobalLock DeleteCriticalSection ExitProcess

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

214KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

Zero Generator.zip

Zero Generator.exe

version

shell32

advapi32

user32

gdiplus

gdi32

ole32

winhttp

ws2_32

wlanapi

winmm

avicap32

d3d11

kernel32

generic