stealer[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
stealer.exe
Size 1.5MB
Sample261027-2qfksahs2q
SHA256 4ca6ca85d70ed0b821313f16d9882cd530e31e6d87bb838ea4fd8635bd3e331d
MD5 4b4ae6181d99c7803ec0049d93ce0fc8
SHA1 492b34dc7b0e78d3a70acd9e72dbe1aea5dd96df
SHA512 33853f0a56d320c8dc90fea9ee8f78a399fb139f08af84ec6af1934fecf5ace0033ccfa45b02792b5748ba79e1e931c3b9a8f98b4a51abd891b842bd864e3cdd
SSDEEP 24576:8YCvhMjAlZtECgsMnWzoRbFBEDqymU50D4AG2W72U+uit4FmBepXSFGtTC:8Yg2tsMnOoRZBEDqyP52e2FU7FJ/pC
TLSH
T113658F07E3B900EDD067C279C9169A17EF72B8051724ABDF5790CA662F23DE15B7A320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
stealer.exe

File Explorer

stealer.exe

.exe 1.5MB

stealer.exe

IMPHASH 85881285609aaabe186bab437f4a6329
SHA256 4ca6ca85d70ed0b821313f16d9882cd530e31e6d87bb838ea4fd8635bd3e331d
MD5 4b4ae6181d99c7803ec0049d93ce0fc8
SHA1 492b34dc7b0e78d3a70acd9e72dbe1aea5dd96df
SHA512 33853f0a56d320c8dc90fea9ee8f78a399fb139f08af84ec6af1934fecf5ace0033ccfa45b02792b5748ba79e1e931c3b9a8f98b4a51abd891b842bd864e3cdd
SSDEEP 24576:8YCvhMjAlZtECgsMnWzoRbFBEDqymU50D4AG2W72U+uit4FmBepXSFGtTC:8Yg2tsMnOoRZBEDqyP52e2FU7FJ/pC
TLSH
T113658F07E3B900EDD067C279C9169A17EF72B8051724ABDF5790CA662F23DE15B7A320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1081952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetCloseHandle InternetConnectA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetOpenA

crypt32

CryptUnprotectData

bcrypt

BCryptCreateHash BCryptDestroyKey BCryptDecrypt BCryptFinishHash BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider BCryptHashData BCryptDestroyHash BCryptDeriveKeyPBKDF2 BCryptGenerateSymmetricKey

advapi32

GetUserNameA

ole32

CoCreateGuid

iphlpapi

GetAdaptersInfo

kernel32

GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale SetStdHandle WriteConsoleW GetLocaleInfoW LCMapStringW GetTimeZoneInformation ReleaseSRWLockExclusive GetEnvironmentVariableA DeleteFileA GetTempPathA CloseHandle WaitForSingleObject Sleep GetCurrentProcessId TerminateProcess CreateRemoteThread GetCurrentThreadId CreateProcessA OpenProcess GetTickCount GetVersionExA VirtualAllocEx WriteProcessMemory GetModuleFileNameA GetModuleHandleA GetProcAddress LocalFree MoveFileExA GetComputerNameA CreateToolhelp32Snapshot Process32FirstW Process32NextW FlushFileBuffers GetDriveTypeW QueryPerformanceCounter MapViewOfFile CreateFileMappingW GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary GetProcessHeap LockFileEx SetFilePointerEx HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo HeapReAlloc DeleteFileW WaitForSingleObjectEx FlushViewOfFile GetFileAttributesExW GetLastError GetTickCount64 FormatMessageW MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW GetTempPathW UnlockFileEx SetEndOfFile OutputDebugStringA WriteFile GetFullPathNameW HeapFree HeapCreate GetFileSizeEx ReadFile AreFileApisANSI RaiseException GetOverlappedResult InitializeSRWLock RtlUnwind AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW CreateFile2 GetModuleHandleW GetFileInformationByHandleEx InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead CompareStringW RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess ExitProcess GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter VirtualProtect LoadLibraryExW

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

stealer.exe

wininet

crypt32

bcrypt

advapi32

ole32

iphlpapi

kernel32

generic