ScreenShot
| Created | 2024.08.21 13:48 | Machine | s1_win7_x6401 |
| Filename | 66bdc869b864d_stealc_cry.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : mailcious | ||
| VT API (file) | 65 detected (AIDetectMalware, Stealerc, tsCt, Windows, Threat, Malicious, score, Trojanpws, Zusy, Unsafe, Vzlc, GenusT, DYTK, Attribute, HighConfidence, Stealc, Artemis, PWSX, TrojanPSW, ccmw, DQwxTsXk3kJ, apiml, PRIVATELOADER, YXEHOZ, Real Protect, moderate, Static AI, Malicious PE, Detected, ai score=83, R660025, BScope, GdSda, Gencirc, GQLJmcXChKQ, Meterpreter, susgen, Vidar, confidence, Cometer) | ||
| md5 | 175e665a8d0021510549eb8557b01bbf | ||
| sha256 | 9b86d8c73fa219bef3689dd13e7ab7996cf4007a5c72ea988de8690fb7b9ea48 | ||
| ssdeep | 3072:y1VO1NFj5qD6o8KaxfE54HnnGiayl+beX8ntto0Q+FrJKa:y1Q1jj5q62aOanGiqbI36FdKa | ||
| imphash | 75f38a281962eafd8c14d2b02cfcdab6 | ||
| impfuzzy | 24:j/8Wfb8J93qsQCTBlR1YzGWtU9fMyDkfjY/J3IQ:j/8Mb8r3qVCTBv1kGWtcfMzKj | ||
Network IP location
Signature (8cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 65 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | Performs some HTTP requests |
| notice | Sends data using the HTTP POST Method |
| info | Checks amount of memory in system |
| info | Queries for the computername |
Rules (7cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Admin_Tool_IN_Zero | Admin Tool Sysinternals | binaries (upload) |
| watch | Antivirus | Contains references to security software | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Suricata ids
ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in
PE API
IAT(Import Address Table) Library
msvcrt.dll
0x41e0ac strncpy
0x41e0b0 ??_V@YAXPAX@Z
0x41e0b4 memchr
0x41e0b8 ??_U@YAPAXI@Z
0x41e0bc strtok
0x41e0c0 strtok_s
0x41e0c4 strcpy_s
0x41e0c8 vsprintf_s
0x41e0cc memmove
0x41e0d0 strlen
0x41e0d4 malloc
0x41e0d8 free
0x41e0dc memcmp
0x41e0e0 ??2@YAPAXI@Z
0x41e0e4 memset
0x41e0e8 memcpy
0x41e0ec __CxxFrameHandler3
KERNEL32.dll
0x41e000 InitializeCriticalSectionAndSpinCount
0x41e004 WideCharToMultiByte
0x41e008 RaiseException
0x41e00c GetStringTypeW
0x41e010 MultiByteToWideChar
0x41e014 LCMapStringW
0x41e018 IsValidCodePage
0x41e01c lstrlenA
0x41e020 HeapAlloc
0x41e024 GetProcessHeap
0x41e028 VirtualProtect
0x41e02c VirtualQueryEx
0x41e030 OpenProcess
0x41e034 ReadProcessMemory
0x41e038 WriteFile
0x41e03c GetOEMCP
0x41e040 GetACP
0x41e044 UnhandledExceptionFilter
0x41e048 SetUnhandledExceptionFilter
0x41e04c IsDebuggerPresent
0x41e050 EncodePointer
0x41e054 DecodePointer
0x41e058 TerminateProcess
0x41e05c GetCurrentProcess
0x41e060 LeaveCriticalSection
0x41e064 EnterCriticalSection
0x41e068 RtlUnwind
0x41e06c GetProcAddress
0x41e070 GetModuleHandleW
0x41e074 ExitProcess
0x41e078 Sleep
0x41e07c GetStdHandle
0x41e080 GetModuleFileNameW
0x41e084 GetLastError
0x41e088 LoadLibraryW
0x41e08c TlsGetValue
0x41e090 TlsSetValue
0x41e094 InterlockedIncrement
0x41e098 SetLastError
0x41e09c GetCurrentThreadId
0x41e0a0 InterlockedDecrement
0x41e0a4 GetCPInfo
EAT(Export Address Table) is none
msvcrt.dll
0x41e0ac strncpy
0x41e0b0 ??_V@YAXPAX@Z
0x41e0b4 memchr
0x41e0b8 ??_U@YAPAXI@Z
0x41e0bc strtok
0x41e0c0 strtok_s
0x41e0c4 strcpy_s
0x41e0c8 vsprintf_s
0x41e0cc memmove
0x41e0d0 strlen
0x41e0d4 malloc
0x41e0d8 free
0x41e0dc memcmp
0x41e0e0 ??2@YAPAXI@Z
0x41e0e4 memset
0x41e0e8 memcpy
0x41e0ec __CxxFrameHandler3
KERNEL32.dll
0x41e000 InitializeCriticalSectionAndSpinCount
0x41e004 WideCharToMultiByte
0x41e008 RaiseException
0x41e00c GetStringTypeW
0x41e010 MultiByteToWideChar
0x41e014 LCMapStringW
0x41e018 IsValidCodePage
0x41e01c lstrlenA
0x41e020 HeapAlloc
0x41e024 GetProcessHeap
0x41e028 VirtualProtect
0x41e02c VirtualQueryEx
0x41e030 OpenProcess
0x41e034 ReadProcessMemory
0x41e038 WriteFile
0x41e03c GetOEMCP
0x41e040 GetACP
0x41e044 UnhandledExceptionFilter
0x41e048 SetUnhandledExceptionFilter
0x41e04c IsDebuggerPresent
0x41e050 EncodePointer
0x41e054 DecodePointer
0x41e058 TerminateProcess
0x41e05c GetCurrentProcess
0x41e060 LeaveCriticalSection
0x41e064 EnterCriticalSection
0x41e068 RtlUnwind
0x41e06c GetProcAddress
0x41e070 GetModuleHandleW
0x41e074 ExitProcess
0x41e078 Sleep
0x41e07c GetStdHandle
0x41e080 GetModuleFileNameW
0x41e084 GetLastError
0x41e088 LoadLibraryW
0x41e08c TlsGetValue
0x41e090 TlsSetValue
0x41e094 InterlockedIncrement
0x41e098 SetLastError
0x41e09c GetCurrentThreadId
0x41e0a0 InterlockedDecrement
0x41e0a4 GetCPInfo
EAT(Export Address Table) is none