Overview

overview

10

Static

static

3

PW-1234-uÑ...€ .exe

windows7-x64

PW-1234-uÑ...€ .exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PW-1234-uрdаtе-2023.rar

  • Size

    52.4MB

  • Sample

    230609-v6cqhacg53

  • MD5

    acc1a8db891acf8e45f910bdd9e1e7ad

  • SHA1

    580e025aadc27e75775bd2f7872b093a267179df

  • SHA256

    0f48e8efeed6683cf4ead95969cd5b4f456e57609b6bf2c5789ac5371c43e0d2

  • SHA512

    a77df49f7313f4c39db818e4d3abd1b2ed6d56ce2a2046ea4860c5b92b0d6254164b8f1069c3e34900b5dc7694542332a4925fc6eb5056cde2343e651571ea02

  • SSDEEP

    1572864:c5FdlgUhxzhqM2AGD7EYpWaZMcuWMqrbX7:sFjFBUsGDLUaZMQ5X

Score
10/10
stealcdiscoveryspywarestealer

Malware Config

Extracted

Family

stealc

C2

http://194.180.48.246/61075d6e14fcb071.php

Targets

    • Target

      PW-1234-uрdаtе-2023/new/Setuр .exe

    • Size

      1019.0MB

    • MD5

      87fce433ad8c2f78da34de8f8388335f

    • SHA1

      ac01e945d452a00563e7ce9233ef544224e21171

    • SHA256

      c87fb2459323c994d70fb278f9499dc4eca88ff4e9f8343e78ad2583dcbaef9f

    • SHA512

      fbd06545fdcb1f93ac3b9f8ae5a63d6615372e96e4a3c4513762184bd6409c2d08b641804ba2019370b72aae888d079c3301f8206dac9a8f1ee26a06f811b41a

    • SSDEEP

      196608:5YlXDl/fT7nODAUo97k7+aJCoYlXDl/fT7nODAUo97k7+aJC:

    Score
    10/10
    stealcdiscoveryspywarestealer

    • Detects Stealc stealer

      stealer

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks