General

  • Target

    09d8461f2d7a58c2c46dd22ff5027f3a21721c5bd3ed4b10c4c6ba88759cfa80_JC.exe

  • Size

    202KB

  • Sample

    231006-pgqceabb6s

  • MD5

    186a82f19c9d8f48b18f8bc85bd21a6a

  • SHA1

    a55c532b0781415113c20bf7c6b12e91209afc7b

  • SHA256

    09d8461f2d7a58c2c46dd22ff5027f3a21721c5bd3ed4b10c4c6ba88759cfa80

  • SHA512

    083c2b0f0c43a47ee87296399c94a586c90b4484dad4c5069006c1892184a577628daecea78c7340dc266bb508e49dbb79aea0a049bc9900e994201665dba4bc

  • SSDEEP

    3072:BRPJCKJKdGXk6JJkg7w7rGc0haGf3hLlZt75S/Vr:VCpQXk6obPGXnf3Jt6V

Malware Config

Extracted

Family

stealc

C2

http://jesseaustin.top

Attributes
  • url_path

    /e9c345fc99a4e67e.php

rc4.plain

Targets

    • Target

      09d8461f2d7a58c2c46dd22ff5027f3a21721c5bd3ed4b10c4c6ba88759cfa80_JC.exe

    • Size

      202KB

    • MD5

      186a82f19c9d8f48b18f8bc85bd21a6a

    • SHA1

      a55c532b0781415113c20bf7c6b12e91209afc7b

    • SHA256

      09d8461f2d7a58c2c46dd22ff5027f3a21721c5bd3ed4b10c4c6ba88759cfa80

    • SHA512

      083c2b0f0c43a47ee87296399c94a586c90b4484dad4c5069006c1892184a577628daecea78c7340dc266bb508e49dbb79aea0a049bc9900e994201665dba4bc

    • SSDEEP

      3072:BRPJCKJKdGXk6JJkg7w7rGc0haGf3hLlZt75S/Vr:VCpQXk6obPGXnf3Jt6V

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks