vryxen | a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9.zip
Size 4.4MB
Sample261012-sdps9asz9p
SHA256 abf45599bd5975e37c1e8e98c393e12c710414fa32a8b0dc34d609ac71ecb594
MD5 c96180a5b4d250aef1f27aabe50d6b0d
SHA1 7823b487fba01faa8e416f003bcb71b0d2b458cd
SHA512 51fd3d4a32212cfdad7e884723847726f844a3109868fdc5c8b0a5c7da24058b84cbd646ce1b987c88f91350b884b414478cf144f89529e3c67ecefae50f316b
SSDEEP 98304:KD13PYS647NHK0EGQZwlfevLBBTm2PKETe4jDiMlE7:KlYW7hKVGQulf6NNTjDiu4
TLSH
T1762633C3429DE425D77BBEA2CD5E8009375313ADF5C78EEA85BA391DBC4984890613F8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer vryxen

Malware Config

Signatures

Family: Vryxen
Vryxen is an open-source stealer written in Golang.
stealer vryxen

Detects Vryxen stealer 1 IoCs

resource	yara_rule
static1/unpack001/a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9	family_vryxen

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9

File Explorer

a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9.zip

.zip 4.4MB
a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9

.exe 10.5MB

a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9.zip

SHA256 abf45599bd5975e37c1e8e98c393e12c710414fa32a8b0dc34d609ac71ecb594
MD5 c96180a5b4d250aef1f27aabe50d6b0d
SHA1 7823b487fba01faa8e416f003bcb71b0d2b458cd
SHA512 51fd3d4a32212cfdad7e884723847726f844a3109868fdc5c8b0a5c7da24058b84cbd646ce1b987c88f91350b884b414478cf144f89529e3c67ecefae50f316b
SSDEEP 98304:KD13PYS647NHK0EGQZwlfevLBBTm2PKETe4jDiMlE7:KlYW7hKVGQulf6NNTjDiu4
TLSH
T1762633C3429DE425D77BBEA2CD5E8009375313ADF5C78EEA85BA391DBC4984890613F8
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9
MD5 135c5c1831f1788709057fdd5b7b1cd0
SHA1 8da7b9c422ca5ea933b7e2ce77bfff4d60a9bd6a
SHA512 cc4099978950760a88673c0e464c9a84819514d2b5ed23d3406f36ab36fb8af7d8966ecdcdd283e7b4586f4235ad19fc1c8aa3a9c70fb8e8b18d46b18159d087
SSDEEP 98304:jfxwSs1ZgWBY08oiCbU5nn9Jb+ywx5Wp79IF8B+NE:jZwHUWBZ8oto5Cy791
TLSH
T15DB64B47E8B541E9C0ADD5358A669123BA713C884F3423D72B60FB682F77BE0ADB5740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Vryxen stealer
Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

507904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

493KB

Virtual Size

856KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9.zip

a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9

kernel32

generic