Overview

overview

10

Static

static

10

f234b6d180...44.exe

windows7_x64

10

f234b6d180...44.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f234b6d1801e1d4105de18a74ecd99f64cbdd7c47d6079bb2994d38ed7b0de44.bin
  • Size 120KB
  • Sample220216-n7n2labfd7
  • SHA256 f234b6d1801e1d4105de18a74ecd99f64cbdd7c47d6079bb2994d38ed7b0de44
  • MD5 SHA1 SHA512
Score
10/10
allcomestealer

Malware Config

Extracted

Family

  • allcome

C2

  • http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/exp.php?usr=ssska

Wallets

  • rGWRCDTnxm6PbeTquXpfGaJUCdJPQa9YCU

  • THd43QUSXYv3uuHuvg1TtnDx1LZghcxoEW

  • GCQ3W4M3FC7JQ7XS5QVUFJATPPRP7XOBJOBCQLQVHG5WHISN4HKJRZZG

  • 47hVDokEdB8HbH7eKR7DLgeDXm7m6q3JmWRzBAgNq5jHEZecWrdzp1sTE1EXRU5rAj2roRSYnzvTxaxq4nDdVdGdTQAsH1y

  • qq6qmn7hewgsnesl2xjh7vjqf2cg2ysdhusx5jjygs

  • bc1qqpuu63gd8v87yvkjw6zgwr7u5plx5hs5z4khje

  • 0xfaCC30908F531Badecb2e8B21E182520484Fb66B

  • Ldh6yphmCg3gLkigDchATQN9Wbj7K6Zdzy

Targets

    • Target
      f234b6d1801e1d4105de18a74ecd99f64cbdd7c47d6079bb2994d38ed7b0de44.bin
    • Size 120KB
    • SHA256 f234b6d1801e1d4105de18a74ecd99f64cbdd7c47d6079bb2994d38ed7b0de44
    • MD5 SHA1 SHA512
    Score
    10/10
    allcomestealer

    • Allcome

      A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

      stealerallcome

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks