General

  • Target

    7ee1aa611e4879f3f851f2c445801561b7023cbaa11849dc31c22cc4f7c65ca5

  • Size

    272KB

  • Sample

    231105-kyly4afd82

  • MD5

    9d7e40be6e3f88b44c63a172416f2ffc

  • SHA1

    99447ae7f70650405bb0b7c9c9e36ca3536d505d

  • SHA256

    7ee1aa611e4879f3f851f2c445801561b7023cbaa11849dc31c22cc4f7c65ca5

  • SHA512

    32030acf077c6ed327893ef1c6c66dd2ad5ba842cebcc6d3b2767bd967bceed0ed9f9b6294041478c693fff5ae73727911a1558362e7161e9b80a8ecbe7dbeb2

  • SSDEEP

    3072:5FVXA0M0L0kiq03Lbfb8N2NO5skpQKSnWrk5VLIxRM+GFpdfP5VW19WnU+:JAr0LZP0XD8N2NPbEkIR5GFpNW19O

Malware Config

Extracted

Family

stealc

C2

http://williammoore.top

Attributes
  • url_path

    /40d570f44e84a454.php

rc4.plain

Targets

    • Target

      7ee1aa611e4879f3f851f2c445801561b7023cbaa11849dc31c22cc4f7c65ca5

    • Size

      272KB

    • MD5

      9d7e40be6e3f88b44c63a172416f2ffc

    • SHA1

      99447ae7f70650405bb0b7c9c9e36ca3536d505d

    • SHA256

      7ee1aa611e4879f3f851f2c445801561b7023cbaa11849dc31c22cc4f7c65ca5

    • SHA512

      32030acf077c6ed327893ef1c6c66dd2ad5ba842cebcc6d3b2767bd967bceed0ed9f9b6294041478c693fff5ae73727911a1558362e7161e9b80a8ecbe7dbeb2

    • SSDEEP

      3072:5FVXA0M0L0kiq03Lbfb8N2NO5skpQKSnWrk5VLIxRM+GFpdfP5VW19WnU+:JAr0LZP0XD8N2NPbEkIR5GFpNW19O

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks