metastealer | 2634e98693c22d899a46c988e808478b0d5858072f713bbd6a22767b33b0ffd4

General

Target

injection.exe
Size

2.4MB
Sample

220414-w9srkadddp
MD5

4669a30d5696a7693509e052ccb2012d
SHA1

2888af7483c35f38fdd1658e7a4fccc87df9d7f5
SHA256

2634e98693c22d899a46c988e808478b0d5858072f713bbd6a22767b33b0ffd4
SHA512

13a64623b2ae8d265051cb4c814788a88e89d5273ab0271131f244f02444e6cfd200d8e149ce20ac22ef095adf9a00504246937e8302ad6b4bb301e8a40f75b7

Score

10^/10

Malware Config

Targets

- Target
  
  injection.exe
- Size
  
  2.4MB
- MD5
  
  4669a30d5696a7693509e052ccb2012d
- SHA1
  
  2888af7483c35f38fdd1658e7a4fccc87df9d7f5
- SHA256
  
  2634e98693c22d899a46c988e808478b0d5858072f713bbd6a22767b33b0ffd4
- SHA512
  
  13a64623b2ae8d265051cb4c814788a88e89d5273ab0271131f244f02444e6cfd200d8e149ce20ac22ef095adf9a00504246937e8302ad6b4bb301e8a40f75b7
Score

10^/10

metastealer discovery evasion persistence spyware stealer suricata trojan
- Meta Stealer Stealer
  Meta Stealer steals passwords stored in browsers, written in C++.
  stealer metastealer
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Registers COM server for autorun
  persistence
- UAC bypass
  evasion trojan
- suricata: ET MALWARE DCRAT Activity (GET)
  suricata: ET MALWARE DCRAT Activity (GET)
  suricata
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1