General

  • Target
    mudinho.exe
  • Size 70.6MB
  • Sample261007-y589vset2w
  • SHA256 4ad8a7d5968ebe4389cbeb66d84d51d0f90ffa55b21e6e073d574102dfa2fd65
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • Unsigned PE 18 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • mudinho.exe
    .exe 70.6MB
  • $PLUGINSDIR/SpiderBanner.dll
    .dll 9KB
  • $PLUGINSDIR/StdUtils.dll
    .dll 100KB
  • $PLUGINSDIR/System.dll
    .dll 12KB
  • $PLUGINSDIR/app-64.7z
    .7z 69.9MB
  • LICENSE.electron.txt
    1KB
  • Mudinho Stealer.exe
    .exe 180.0MB
  • chrome_100_percent.pak
    148KB
  • chrome_200_percent.pak
    223KB
  • ffmpeg.dll
    .dll 2.8MB
  • icudtl.dat
    10.0MB
  • libEGL.dll
    .dll 481KB
  • libGLESv2.dll
    .dll 8.0MB
  • locales/en-US.pak
    478KB
  • resources.pak
    5.5MB
  • resources/app.asar
    .js 63KB
  • resources/build.json
    460B
  • resources/content/help.js
    .js 2KB
  • resources/content/index.html
    .html 5KB
  • resources/content/settings.json
    118B
  • resources/content/styles.css
    2KB
  • resources/elevate.exe
    .exe 105KB
  • resources/endpoint.bin
    149B
  • resources/features.json
    267B
  • resources/payload/enc/collectors/browsers/chromium.bin
    19KB
  • resources/payload/enc/collectors/browsers/firefox.bin
    13KB
  • resources/payload/enc/collectors/crypto/wallets.bin
    445KB
  • resources/payload/enc/collectors/discord.bin
    20KB
  • resources/payload/enc/collectors/gaming.bin
    9KB
  • resources/payload/enc/collectors/system.bin
    24KB
  • resources/payload/enc/collectors/telegram.bin
    5KB
  • resources/payload/enc/main.bin
    22KB
  • resources/payload/enc/native/addon.bin
    1KB
  • resources/payload/enc/native/native-async.bin
    1KB
  • resources/payload/enc/persist.bin
    2KB
  • resources/payload/enc/upload/discord.bin
    45KB
  • resources/payload/enc/upload/report.bin
    24KB
  • resources/payload/native/abe/abe_extractor_amd64.bin.enc
    21KB
  • resources/payload/native/build/Release/addon.node.enc
    789KB
  • resources/payload/node_modules/better-sqlite3/LICENSE
    1KB
  • resources/payload/node_modules/better-sqlite3/README.md
    5KB
  • resources/payload/node_modules/better-sqlite3/lib/binding/node-v115-win32-x64/better_sqlite3.node
    .dll 1.6MB
  • resources/payload/node_modules/better-sqlite3/lib/binding/node-v130-win32-x64/better_sqlite3.node
    .dll 1.6MB
  • resources/payload/node_modules/better-sqlite3/lib/database.js
    .js 4KB
  • resources/payload/node_modules/better-sqlite3/lib/index.js
    110B
  • resources/payload/node_modules/better-sqlite3/lib/methods/aggregate.js
    .js 1KB
  • resources/payload/node_modules/better-sqlite3/lib/methods/backup.js
    .js 2KB
  • resources/payload/node_modules/better-sqlite3/lib/methods/function.js
    .js 1KB
  • resources/payload/node_modules/better-sqlite3/lib/methods/inspect.js
    174B
  • resources/payload/node_modules/better-sqlite3/lib/methods/pragma.js
    536B
  • resources/payload/node_modules/better-sqlite3/lib/methods/serialize.js
    625B
  • resources/payload/node_modules/better-sqlite3/lib/methods/table.js
    .js 6KB
  • resources/payload/node_modules/better-sqlite3/lib/methods/transaction.js
    .js 2KB
  • resources/payload/node_modules/better-sqlite3/lib/methods/wrappers.js
    1KB
  • resources/payload/node_modules/better-sqlite3/lib/sqlite-error.js
    717B
  • resources/payload/node_modules/better-sqlite3/lib/util.js
    .js 331B
  • resources/payload/node_modules/better-sqlite3/package.json
    1KB
  • resources/payload/node_modules/bindings/LICENSE.md
    1KB
  • resources/payload/node_modules/bindings/bindings.js
    .js 5KB
  • resources/payload/node_modules/bindings/package.json
    660B
  • resources/payload/node_modules/file-uri-to-path/LICENSE
    1KB
  • resources/payload/node_modules/file-uri-to-path/index.js
    .js 1KB
  • resources/payload/node_modules/file-uri-to-path/package.json
    717B
  • resources/prune.json
    301B
  • resources/salt.bin
    140B
  • snapshot_blob.bin
    309KB
  • v8_context_snapshot.bin
    671KB
  • $PLUGINSDIR/nsExec.dll
    .dll 6KB
  • $PLUGINSDIR/nsis7z.dll
    .dll 424KB
  • $R0/Uninstall Mudinho Stealer.exe
    .exe 362KB
  • $PLUGINSDIR/StdUtils.dll
    .dll 100KB
  • $PLUGINSDIR/System.dll
    .dll 12KB
  • $PLUGINSDIR/WinShell.dll
    .dll 3KB
  • $PLUGINSDIR/nsExec.dll
    .dll 6KB

mudinho.exe

  • IMPHASH b34f154ec913d2d2c435cbd644e91687
  • SHA256 4ad8a7d5968ebe4389cbeb66d84d51d0f90ffa55b21e6e073d574102dfa2fd65
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
4
Entry point
13199
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths