c6a03d8a7c73751409d693a59f052b4e4e2e629a9cb2613abc220a571e7782f5.zip
- SHA256 aa165b54ed78999ca1e3ee31cd87e224d056fe73e67bb905ce5245084250f2b9
Password
infected
Behavioral task
behavioral1
Sample
c6a03d8a7c73751409d693a59f052b4e4e2e629a9cb2613abc220a571e7782f5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
c6a03d8a7c73751409d693a59f052b4e4e2e629a9cb2613abc220a571e7782f5.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target c6a03d8a7c73751409d693a59f052b4e4e2e629a9cb2613abc220a571e7782f5.zip
- Size 2.0MB
- Sample261109-csph2agy3m
- SHA256 aa165b54ed78999ca1e3ee31cd87e224d056fe73e67bb905ce5245084250f2b9
- MD5 29ee572ebe3fe824d95aca2a0343c1e8
- SHA1 99dbde7ad22eb8d987db7fe8587f804ce4c06547
- SHA512 b8ec9dda2c1388c882e59624bf37bc9593198ac9c401af3e0d02f854e500ec721919754b98c2a4014292d7e86025772da0b633211eca6bfe420e165b55b1b97b
- SSDEEP 49152:NcJhniLotqAigUnuV9FcrZGhpfsF85Xa8zTxWyeJOex+XsX:sviBnwFcMhRsF8xayWVzx+m
- TLSH T19FA53325D3BE6CA92F79CD6C464F9042698BF05CD6EB910CCB1B982811186FFB570ACD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
saturn_stealer
C2
-
https://api.telegram.org/bot8395053133:AAFMfxPo_NC_t0oUSTJBUKdCVioKS1NQOUo/sendMessage?chat_id=8574357307
Signatures
- Family: ChromElevator
ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.
- Family: SaturnStealer
SaturnStealer is a Windows stealer written in C++.
- Detects ChromElevator 1 IoCs
resource yara_rule static1/unpack001/c6a03d8a7c73751409d693a59f052b4e4e2e629a9cb2613abc220a571e7782f5 family_chromelevator - Detects SaturnStealer 1 IoCs
resource yara_rule static1/unpack001/c6a03d8a7c73751409d693a59f052b4e4e2e629a9cb2613abc220a571e7782f5 family_saturnstealer - Custom signatureDetect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/c6a03d8a7c73751409d693a59f052b4e4e2e629a9cb2613abc220a571e7782f5 suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/c6a03d8a7c73751409d693a59f052b4e4e2e629a9cb2613abc220a571e7782f5
File Explorer
-
c6a03d8a7c73751409d693a59f052b4e4e2e629a9cb2613abc220a571e7782f5.zip.zip 2.0MB
-
c6a03d8a7c73751409d693a59f052b4e4e2e629a9cb2613abc220a571e7782f5.exe 2.8MB
c6a03d8a7c73751409d693a59f052b4e4e2e629a9cb2613abc220a571e7782f5
- IMPHASH 482376bc49dbb897e033716666955d5f
- SHA256 c6a03d8a7c73751409d693a59f052b4e4e2e629a9cb2613abc220a571e7782f5
- MD5 5f9993df17835cadc10bc98cf63759e3
- SHA1 f6a17ee312266e1f41691c66c4f7e08f46f0727a
- SHA512 4121e97f9a4ae27a981859ac36ae5ad4a6f970c0f8410275a4d8d73c50b84a2f2e3575c9d791152ef4ba499455d9d1177be060cd1301f086ab7ba6bf2e310246
- SSDEEP 49152:5T5Wj5hMKtPZQBbo2BiIQEZQLA9dXDLamxHYlU8+BODtqthO5YFTkRWIDxb0w3Cr:+1hMKdZEN/jDeiYcBK5iToWku5
- TLSH T155D5D05AF3A440FCD067C5B4CF069513EBB2B8061734A6DF57918D962F23BA26A3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects ChromElevator
-
Detects SaturnStealer
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
1131504
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
shell32
SHGetKnownFolderPath
CommandLineToArgvW
advapi32
RegQueryValueExA
GetUserNameA
OpenProcessToken
GetTokenInformation
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegCloseKey
user32
GetSystemMetrics
ReleaseDC
GetDC
ole32
CoTaskMemFree
CoInitializeEx
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
VariantInit
VariantClear
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
wininet
HttpQueryInfoA
HttpOpenRequestA
InternetOpenUrlA
HttpAddRequestHeadersA
InternetCloseHandle
InternetReadFile
InternetConnectA
HttpSendRequestA
InternetOpenA
crypt32
CryptStringToBinaryA
CryptUnprotectData
bcrypt
BCryptDecrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptSetProperty
BCryptDestroyKey
gdi32
DeleteDC
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SelectObject
gdiplus
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipFree
GdipAlloc
GdipSaveImageToFile
GdipCloneImage
GdipGetImageEncodersSize
kernel32
GetTimeZoneInformation
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
IsValidCodePage
LoadLibraryExW
VirtualProtect
CreatePipe
GetConsoleMode
GetConsoleOutputCP
GetFileType
SetFilePointerEx
GetFileSizeEx
GetACP
GetOEMCP
GetCommandLineA
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetModuleFileNameW
TerminateProcess
ExitProcess
IsProcessorFeaturePresent
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
CompareStringW
GetDiskFreeSpaceA
FreeLibraryAndExitThread
ExitThread
CreateThread
DuplicateHandle
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetLastError
ReadFile
SizeofResource
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetCommandLineW
GetCurrentProcess
GetStdHandle
WriteFile
ExpandEnvironmentStringsW
CreateNamedPipeW
PeekNamedPipe
GetTempPathW
WaitForSingleObject
GetCurrentThreadId
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
LockResource
Process32FirstW
CloseHandle
GetSystemInfo
LoadResource
FindResourceW
GetLocalTime
GetProcAddress
LocalFree
ReadProcessMemory
GetCurrentProcessId
SystemTimeToFileTime
GlobalMemoryStatusEx
CreateProcessW
GetModuleHandleW
WideCharToMultiByte
CreateProcessA
K32GetMappedFileNameW
GetTickCount
ConnectNamedPipe
VirtualQueryEx
GetComputerNameA
GetExitCodeProcess
GetCurrentThread
GetThreadContext
IsDebuggerPresent
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
CreateMutexW
CreateFileW
GetFileAttributesW
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
FormatMessageW
RtlUnwind
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
RaiseException
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
LockFileEx
GetFileSize
DeleteCriticalSection
GetProcessHeap
FreeLibrary
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
FlushFileBuffers
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileInformationByHandle
GetFinalPathNameByHandleW
SetFileInformationByHandle
CreateFile2
DeviceIoControl
CopyFile2
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
RtlPcToFileHeader
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
GetLocaleInfoEx
QueryPerformanceFrequency
InitOnceComplete
InitOnceBeginInitialize
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
WakeAllConditionVariable
LCMapStringEx
InitializeCriticalSectionEx
EncodePointer
DecodePointer
GetStringTypeW
CompareStringEx
GetCPInfo
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
RtlLookupFunctionEntry
RtlUnwindEx
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
268KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=195, id=261, version=33145,
count=8, id=259, version=33145,
count=18, id=260, version=35721,
count=1, id=263, version=33145,
count=12, id=259, version=35721,
count=103, id=261, version=35721,
count=19, id=260, version=33145,
count=1, id=262, version=33145,
count=23, id=257, version=33145,
count=263, id=1, productName=Unmarked objects,
count=4, id=265, version=36252,
count=1, id=259, version=36252,
count=1, id=255, version=36252,
count=1, id=258, version=36252,