coldstealer | 8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b | Triage

Sharing

General

Target

8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.bin
Size

505KB
Sample

220705-pxvxtsbbe9
MD5

a48f8e50e74b3792eeaffc6d25ca0080
SHA1

37b5e5a237164f304e960a82a3e8ce561d71c02d
SHA256

8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b
SHA512

e43010c9a0c35e7bdecd2bcdb40ad115697e09bf6922dc2c4a2421e30313fa5aded5babc72a6cbac874c304f629d511adcfa4053b2b88142272678f6d03d4030

Score

10^/10

coldstealer l2 discovery spyware stealer

Malware Config

Extracted

Family

coldstealer

Botnet

l2

C2

http://realacademicmediausa.com/

Targets

- Target
  
  8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.bin
- Size
  
  505KB
- MD5
  
  a48f8e50e74b3792eeaffc6d25ca0080
- SHA1
  
  37b5e5a237164f304e960a82a3e8ce561d71c02d
- SHA256
  
  8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b
- SHA512
  
  e43010c9a0c35e7bdecd2bcdb40ad115697e09bf6922dc2c4a2421e30313fa5aded5babc72a6cbac874c304f629d511adcfa4053b2b88142272678f6d03d4030
Score

10^/10

coldstealer l2 discovery spyware stealer
- Cold Stealer
  An info stealer written in C#, first seen in Feb 2022.
  stealer coldstealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

coldstealerl2discoveryspywarestealer

behavioral2

coldstealerdiscoveryspywarestealer