coldstealer | 1fd2625f418014cdb9bb1bac15eecfa1b05ad9a3000385c7a3daf3a6b1f2f650 | Triage

Sharing

General

Target

1fd2625f418014cdb9bb1bac15eecfa1b05ad9a3000385c7a3daf3a6b1f2f650.bin
Size

169KB
Sample

220705-pxr6yahcem
MD5

485edc4695212c4e97cf2e841661151c
SHA1

8d78e5b67eea3014f1a3530e68e7c1c21750990e
SHA256

1fd2625f418014cdb9bb1bac15eecfa1b05ad9a3000385c7a3daf3a6b1f2f650
SHA512

e5d520366b20bd57b1bd90abcc8e243e4a4d3f0e108c316da7ed0d6f715cc293971e616c479da5d29f09976de8f950ab8072e8fa0feaf848f2727150a86f141c

Score

10^/10

coldstealer 18 discovery spyware stealer

Malware Config

Extracted

Family

coldstealer

Botnet

18

C2

http://realmoneycreate.xyz/

Targets

- Target
  
  1fd2625f418014cdb9bb1bac15eecfa1b05ad9a3000385c7a3daf3a6b1f2f650.bin
- Size
  
  169KB
- MD5
  
  485edc4695212c4e97cf2e841661151c
- SHA1
  
  8d78e5b67eea3014f1a3530e68e7c1c21750990e
- SHA256
  
  1fd2625f418014cdb9bb1bac15eecfa1b05ad9a3000385c7a3daf3a6b1f2f650
- SHA512
  
  e5d520366b20bd57b1bd90abcc8e243e4a4d3f0e108c316da7ed0d6f715cc293971e616c479da5d29f09976de8f950ab8072e8fa0feaf848f2727150a86f141c
Score

10^/10

coldstealer 18 discovery spyware stealer
- Cold Stealer
  An info stealer written in C#, first seen in Feb 2022.
  stealer coldstealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

coldstealer18discoveryspywarestealer

behavioral2

discoveryspywarestealer