859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.zip
- SHA256 aff406fe214a04e22a486323704ef7c623e6af3e933aff0e25195403affe03ff
Password
infected
Behavioral task
behavioral1
Sample
859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.zip
- Size 287KB
- Sample261110-p25b3afe52
- SHA256 aff406fe214a04e22a486323704ef7c623e6af3e933aff0e25195403affe03ff
- MD5 fb8dad7356daadcd8722428731a5a41e
- SHA1 3f1d391c333f4588f375f390eac77813cc80f2dd
- SHA512 c57964f06c1cae4fc4436740aaf76d730f6c42f7e8f54821e3c227dd03e42bc4d0c3c95942ff79385d5d95d682fd69428d65f1827d84882c8f5bf5ae6f9d0809
- SSDEEP 6144:5fKQaGz+9xbfyiDQI1tWzgh0ebqzZ9iwxFp6P8yFbFPi:xKLGzyl62dqu0lzZHxF83FbFPi
- TLSH T14C542364AB4A4FE7740C8BF6A046D0C71103E5FC709BD5ADD05770331ECDA66A0DAA8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
chicken_stealer
C2
-
https://api.telegram.org/bot8919186852:AAEjTtp7vwrqRVtKiiHSVe2vCXiqQJX8sDc/sendMessage?chat_id=8980143221
Attributes
-
localhost
127.0.0.1
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Signatures
- Family: ChickenStealer
ChickenStealer is a Windows infostealer written in C++.
- Detects ChickenStealer 1 IoCs
resource yara_rule static1/unpack001/859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294 family_chickenstealer - Custom signatureDetect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294 suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294
File Explorer
-
859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.zip.zip 287KB
-
859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.exe 679KB
859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294
- IMPHASH 34ff47a53573aada51bd1f365b715f07
- SHA256 859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294
- MD5 3ffe9b94fdd07511c2c8a92d0bf2e8cf
- SHA1 baf3f0291da842279570946f8850ca538cfbf52d
- SHA512 205c53a2b93597426607008038afd3dc6b1d2a9f477673f5330cd8bdb4a5ffb4c5cd55e9c27d25cd6a49bf2fd12ce763a58f58ea53b62b1e81c23775bbf36b34
- SSDEEP 12288:O+tw67SW+Z1acIVFUvW6T/pVfwfzBchoD+r1676Y1GkB2vSVQTkU8rF6H8KXDyP3:F7STZ1aLVK1/pVfw7Bcnr19Y1wTJHnD6
- TLSH T1D2E43B36DB5C017DD1B6C1BA8E0B5813E6B238491331BAEB57C11E631E1F6A4A77AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects ChickenStealer
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
503808
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
crypt32
CryptUnprotectData
CryptStringToBinaryA
bcrypt
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptDecrypt
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptSetProperty
advapi32
GetTokenInformation
GetUserNameA
OpenProcessToken
RegQueryInfoKeyA
CredFree
CredEnumerateA
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
RegEnumKeyExA
RegCloseKey
user32
EnumDisplayDevicesA
OpenClipboard
ReleaseDC
GetDC
GetSystemMetrics
MessageBoxA
ShowWindow
GetClipboardData
CloseClipboard
gdi32
DeleteDC
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
gdiplus
GdipGetImageEncoders
GdipDisposeImage
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipGetImageEncodersSize
GdipAlloc
wininet
InternetOpenUrlA
HttpOpenRequestA
InternetOpenA
InternetCrackUrlA
InternetCloseHandle
InternetSetOptionA
InternetReadFile
HttpSendRequestA
InternetConnectA
iphlpapi
GetAdaptersInfo
kernel32
MultiByteToWideChar
CreateSymbolicLinkW
GetFileInformationByHandleEx
CreateHardLinkW
CopyFile2
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
DeviceIoControl
AreFileApisANSI
CreateFile2
GetTempPathW
SetFileInformationByHandle
GetFinalPathNameByHandleW
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateDirectoryW
GetLocaleInfoEx
SetUnhandledExceptionFilter
GetModuleHandleW
GetTempPathA
GetCurrentProcessId
GetTickCount64
GetModuleFileNameA
CreateFileW
GetFileSize
ReadFile
CloseHandle
WaitForSingleObject
GetCurrentProcess
CreateProcessA
GetLocalTime
GlobalUnlock
GlobalLock
GetComputerNameA
WideCharToMultiByte
IsDebuggerPresent
CheckRemoteDebuggerPresent
GetLastError
CreateMutexA
Sleep
ExitProcess
GetModuleHandleA
GetProcAddress
FreeConsole
GetConsoleWindow
TerminateProcess
CreateRemoteThread
CreateProcessW
VirtualAllocEx
ReadProcessMemory
WriteProcessMemory
LoadLibraryA
LocalFree
GetDiskFreeSpaceExA
GetDriveTypeA
GetVolumeInformationA
GlobalMemoryStatusEx
GetLogicalDriveStringsA
GetSystemPowerStatus
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FreeLibrary
WriteFile
FormatMessageA
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?uncaught_exceptions@std@@YAHXZ
_Mtx_lock
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bios_base@std@@QEBA_NXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?_Xbad_alloc@std@@YAXXZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPEBD@Z
_Strcoll
_Strxfrm
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?setf@ios_base@std@@QEAAHHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Random_device@std@@YAIXZ
__crtLCMapStringA
?_Xlength_error@std@@YAXPEBD@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
vcruntime140
strchr
__std_type_info_compare
__RTtypeid
__current_exception
__current_exception_context
__std_exception_copy
memcmp
__std_terminate
memset
memmove
memcpy
_CxxThrowException
__C_specific_handler
__std_exception_destroy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
realloc
malloc
_callnewh
api-ms-win-crt-string-l1-1-0
wcslen
strcpy_s
isalnum
isdigit
tolower
strlen
api-ms-win-crt-stdio-l1-1-0
fputc
__p__commode
fgetc
fflush
fclose
_get_stream_buffer_pointers
fgetpos
__stdio_common_vsprintf_s
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
fread
_set_fmode
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-runtime-l1-1-0
_initterm_e
exit
_exit
_get_initial_narrow_environment
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
abort
_initialize_onexit_table
_register_onexit_function
_errno
terminate
_initterm
_seh_filter_exe
_crt_atexit
api-ms-win-crt-convert-l1-1-0
strtoll
strtoul
api-ms-win-crt-time-l1-1-0
_localtime64_s
strftime
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_locale_name_func
___lc_codepage_func
___lc_collate_cp_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
526KB
Virtual Size
526KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
124KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
924B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=38, id=261, version=35721,
count=6, id=257, version=35721,
count=19, id=257, version=33145,
count=334, id=1, productName=Unmarked objects,
count=22, id=261, version=36256,
count=1, id=255, version=36256,
count=1, id=258, version=36256,