jaffacakes118_Trojan[.]Win32[.]CoinStealer[.]ar[.]816029f81f09472ab9210546b12abadf

General

Target
jaffacakes118_Trojan.Win32.CoinStealer.ar.816029f81f09472ab9210546b12abadf
Size 110KB
Sample261018-2gexwsbt9z
SHA256 ecafd3307b6387837062bcc737d14544d8086526bb2255c785269777bb5564dd
MD5 816029f81f09472ab9210546b12abadf
SHA1 7d29e89e9deb7132e994b8bbc612fea1ca05d28c
SHA512 9a00c7c0812ac07e8ea24928ff3bd83d0aa602d116606c30abf3226e27b73f5460d5ebd904588e409e958141efe4fd840a21c79df76a93c70645fc73831e3f29
SSDEEP 3072:ofN8LTOCs98sXvpexDziaOlLYLCgr2hnsu:k8/ORQx6VuLCDhn
TLSH
T1DCB39E2076C68473E26211718DB99FE64A3EFC325B6034DBFBD905B90E687D18A3531B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.CoinStealer.ar.816029f81f09472ab9210546b12abadf

File Explorer

jaffacakes118_Trojan.Win32.CoinStealer.ar.816029f81f09472ab9210546b12abadf

.exe 110KB

jaffacakes118_Trojan.Win32.CoinStealer.ar.816029f81f09472ab9210546b12abadf

IMPHASH ceef9a7aa92d2d5d4f6b7b508c3983f3
SHA256 ecafd3307b6387837062bcc737d14544d8086526bb2255c785269777bb5564dd
MD5 816029f81f09472ab9210546b12abadf
SHA1 7d29e89e9deb7132e994b8bbc612fea1ca05d28c
SHA512 9a00c7c0812ac07e8ea24928ff3bd83d0aa602d116606c30abf3226e27b73f5460d5ebd904588e409e958141efe4fd840a21c79df76a93c70645fc73831e3f29
SSDEEP 3072:ofN8LTOCs98sXvpexDziaOlLYLCgr2hnsu:k8/ORQx6VuLCDhn
TLSH
T1DCB39E2076C68473E26211718DB99FE64A3EFC325B6034DBFBD905B90E687D18A3531B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

41372

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Admin\Desktop\Bitcoin Buster\Stub\Release\Stub.pdb

kernel32

FindResourceA LoadResource GlobalLock GlobalAlloc Sleep GlobalUnlock LockResource CloseHandle GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapReAlloc GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind HeapAlloc CompareStringW MultiByteToWideChar GetCPInfo WideCharToMultiByte LCMapStringW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress HeapSize ExitProcess HeapCreate WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetUserDefaultLCID GetLocaleInfoW LoadLibraryW

user32

GetClipboardData EmptyClipboard OpenClipboard SetClipboardData CloseClipboard

Sharing