General

  • Target

    2f41ab13ff3d31ff39b85a4ff6501a0f.exe

  • Size

    273KB

  • Sample

    230530-jzeezagf9z

  • MD5

    2f41ab13ff3d31ff39b85a4ff6501a0f

  • SHA1

    c85f68634f73cead79bdc1d5fe787a2ead90ab75

  • SHA256

    bfdfda675bfc0d09a0ae2ab2fba41f9cad1599a1a31f0d38f7728675c6a1f20d

  • SHA512

    0ad01a126b2a02307c4336601ee04af0355d4e0c41654fe5333fba29eb29843aa11b2b64b1169a3b1f7bd216872ca7e46b3be897f33d061195c4fb461bc53a4b

  • SSDEEP

    3072:wqcrom+Xaomkk2dIhDKRoiwL/S8cpGVpgmzLWVy8Vm0O5J+1DABtP1aa5M:zcEm+YkksIFhH7iUOmXWVy1tPwa5

Malware Config

Targets

    • Target

      2f41ab13ff3d31ff39b85a4ff6501a0f.exe

    • Size

      273KB

    • MD5

      2f41ab13ff3d31ff39b85a4ff6501a0f

    • SHA1

      c85f68634f73cead79bdc1d5fe787a2ead90ab75

    • SHA256

      bfdfda675bfc0d09a0ae2ab2fba41f9cad1599a1a31f0d38f7728675c6a1f20d

    • SHA512

      0ad01a126b2a02307c4336601ee04af0355d4e0c41654fe5333fba29eb29843aa11b2b64b1169a3b1f7bd216872ca7e46b3be897f33d061195c4fb461bc53a4b

    • SSDEEP

      3072:wqcrom+Xaomkk2dIhDKRoiwL/S8cpGVpgmzLWVy8Vm0O5J+1DABtP1aa5M:zcEm+YkksIFhH7iUOmXWVy1tPwa5

    • Detects Stealc stealer

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks