General

  • Target

    68591ab0c4904c7c8da879796a093f9abacc12b791f927d90b15332b807aa8de

  • Size

    272KB

  • Sample

    230325-py79jscf85

  • MD5

    7be1aba0aebe6fc4be603238a5ba0649

  • SHA1

    343fb85f4fd3fb956f6d0bf574fe03bfce0ea45f

  • SHA256

    68591ab0c4904c7c8da879796a093f9abacc12b791f927d90b15332b807aa8de

  • SHA512

    62d57c606874da2f0d952c89050b3f5aabe2b4d29b8889249e2a41719bdf078c506edda186b6bab95b0c4744f23e114dc3fcc2bb89b855a3265b7e807b865514

  • SSDEEP

    3072:CIaoPf3RzLmGS9xHAIvD3vVuBCfrhQXcnzLlYeoR2Rs6PL2Uo9rrwPxiYm36CJQD:CKzy9BdVuBUzLakCZsPxKVTf2

Malware Config

Extracted

Family

stealc

C2

http://michaeljohnson.top/410b5129171f10ea.php

Targets

    • Target

      68591ab0c4904c7c8da879796a093f9abacc12b791f927d90b15332b807aa8de

    • Size

      272KB

    • MD5

      7be1aba0aebe6fc4be603238a5ba0649

    • SHA1

      343fb85f4fd3fb956f6d0bf574fe03bfce0ea45f

    • SHA256

      68591ab0c4904c7c8da879796a093f9abacc12b791f927d90b15332b807aa8de

    • SHA512

      62d57c606874da2f0d952c89050b3f5aabe2b4d29b8889249e2a41719bdf078c506edda186b6bab95b0c4744f23e114dc3fcc2bb89b855a3265b7e807b865514

    • SSDEEP

      3072:CIaoPf3RzLmGS9xHAIvD3vVuBCfrhQXcnzLlYeoR2Rs6PL2Uo9rrwPxiYm36CJQD:CKzy9BdVuBUzLakCZsPxKVTf2

    • Detects Stealc stealer

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks