stealc | r10qhf9k[.]exe

General

Target
r10qhf9k.exe
Size 766KB
Sample261111-j6edjsvw8r
SHA256 11090a33facef7746bd3391de518b7587ef62325c46363b52d97ff2954475055
MD5 b4ae31125650dd9326cc6fce2ff206f6
SHA1 c3686a37f0451a3669d57e69d15d46d8297fd1fc
SHA512 550c35f2e68ea2dffd61f124d84a0aaf41c72a21b5ff86a65d415ed9c12d590d62e41c4a8e9365eb406e9618dbb54f538a6ac2c76dbdfe15e78bfe590dacee5e
SSDEEP 12288:tpS+Eg4TzvpO0K+w0MOaCIXZXyxBlDetAqxSvvJ:tw+WfvMxL09a9Xhyb
TLSH
T1C6F47D1AF3A502FCD0BBC178CA524552EB72BC565330A69F03E15A6A1F376906F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

11x06x2026 stealer stealc

Malware Config

Extracted

Family

stealc

Botnet

11x06x2026

C2

http://196.251.107.130/16b022998f754137b60a.php

Attributes

url_path
/16b022998f754137b60a.php

rc4.traffic_key

rc4.plain

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
sample	family_stealc_v3

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
r10qhf9k.exe

File Explorer

r10qhf9k.exe

.exe 766KB

r10qhf9k.exe

IMPHASH b45095de49856a47334e76102f8e7be0
SHA256 11090a33facef7746bd3391de518b7587ef62325c46363b52d97ff2954475055
MD5 b4ae31125650dd9326cc6fce2ff206f6
SHA1 c3686a37f0451a3669d57e69d15d46d8297fd1fc
SHA512 550c35f2e68ea2dffd61f124d84a0aaf41c72a21b5ff86a65d415ed9c12d590d62e41c4a8e9365eb406e9618dbb54f538a6ac2c76dbdfe15e78bfe590dacee5e
SSDEEP 12288:tpS+Eg4TzvpO0K+w0MOaCIXZXyxBlDetAqxSvvJ:tw+WfvMxL09a9Xhyb
TLSH
T1C6F47D1AF3A502FCD0BBC178CA524552EB72BC565330A69F03E15A6A1F376906F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Stealc stealer Version 3
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

292680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle LoadLibraryA GetProcAddress GetCurrentProcess SetEndOfFile QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetLocaleInfoEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess TerminateProcess FreeLibrary WriteFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize RtlUnwind

Name

.text

Size

461KB

Virtual Size

461KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

177KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

r10qhf9k.exe

kernel32

generic