General

  • Target

    1fd2625f418014cdb9bb1bac15eecfa1b05ad9a3000385c7a3daf3a6b1f2f650.bin

  • Size

    169KB

  • Sample

    220705-pxr6yahcem

  • MD5

    485edc4695212c4e97cf2e841661151c

  • SHA1

    8d78e5b67eea3014f1a3530e68e7c1c21750990e

  • SHA256

    1fd2625f418014cdb9bb1bac15eecfa1b05ad9a3000385c7a3daf3a6b1f2f650

  • SHA512

    e5d520366b20bd57b1bd90abcc8e243e4a4d3f0e108c316da7ed0d6f715cc293971e616c479da5d29f09976de8f950ab8072e8fa0feaf848f2727150a86f141c

Malware Config

Extracted

Family

coldstealer

Botnet

18

C2

http://realmoneycreate.xyz/

Targets

    • Target

      1fd2625f418014cdb9bb1bac15eecfa1b05ad9a3000385c7a3daf3a6b1f2f650.bin

    • Size

      169KB

    • MD5

      485edc4695212c4e97cf2e841661151c

    • SHA1

      8d78e5b67eea3014f1a3530e68e7c1c21750990e

    • SHA256

      1fd2625f418014cdb9bb1bac15eecfa1b05ad9a3000385c7a3daf3a6b1f2f650

    • SHA512

      e5d520366b20bd57b1bd90abcc8e243e4a4d3f0e108c316da7ed0d6f715cc293971e616c479da5d29f09976de8f950ab8072e8fa0feaf848f2727150a86f141c

    • Cold Stealer

      An info stealer written in C#, first seen in Feb 2022.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks