stealc | file[.]exe

General

Target
file.exe
Size 615KB
Sample261007-gh48yss1ey
SHA256 a9a97675dd4fd2cad9b66f31c0bb3cf177cfbe40f29a664abce74b11da645984
MD5 30ddf81994d4d81feb012f1419bcab53
SHA1 19e62a6656a739f189d7b3ed9347a860e07ffb11
SHA512 1b7a0941ec736f0010e704ee26dd7a0aa70a0c74b510c09089668a5dad10e1a21eeb265f8de3889cbc170de412d54a96e1e49026fcdec98db5a114da9c574bd0
SSDEEP 12288:PYxFyPpxZjtDRvNNq6E+xthsAEnyxBlDetAqxSvkkKofgK:PY+PjHRlNhhDh/Enybs7of
TLSH
T1C0D4AF12B5A1D476E1724635CC64EB549B7DBC700B209BCB63C00AEA6E716C0AF37B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

my2 stealer stealc

Malware Config

Extracted

Family

stealc

Botnet

my2

C2

http://91.92.241.109/78297b2fa2ac49ca8eb0.php

Attributes

url_path
/78297b2fa2ac49ca8eb0.php

rc4.traffic_key

rc4.plain

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 2 1 IoCs

resource	yara_rule
sample	family_stealc_v2

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
sample	family_stealc_v3

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 615KB

file.exe

IMPHASH 6f6a2d13c671ec1552810ff82e0b59e6
SHA256 a9a97675dd4fd2cad9b66f31c0bb3cf177cfbe40f29a664abce74b11da645984
MD5 30ddf81994d4d81feb012f1419bcab53
SHA1 19e62a6656a739f189d7b3ed9347a860e07ffb11
SHA512 1b7a0941ec736f0010e704ee26dd7a0aa70a0c74b510c09089668a5dad10e1a21eeb265f8de3889cbc170de412d54a96e1e49026fcdec98db5a114da9c574bd0
SSDEEP 12288:PYxFyPpxZjtDRvNNq6E+xthsAEnyxBlDetAqxSvkkKofgK:PY+PjHRlNhhDh/Enybs7of
TLSH
T1C0D4AF12B5A1D476E1724635CC64EB549B7DBC700B209BCB63C00AEA6E716C0AF37B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects Stealc stealer Version 2
Detects Stealc stealer Version 3
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

117219

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle LoadLibraryA GetProcAddress GetCurrentProcess HeapSize QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime Sleep GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetLocaleInfoEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo IsProcessorFeaturePresent SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RaiseException RtlUnwind GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess TerminateProcess FreeLibrary WriteFile IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW SetEndOfFile

Sharing