General

  • Target

    57670e593096256bace1389baa04c0df363f579fce821ff0753d05f065572b32

  • Size

    291KB

  • Sample

    231117-prcjashc56

  • MD5

    263b12572c3cbd3f3246e83830b483ea

  • SHA1

    0b41345bf0979f5c48a0106435b217baf7169a13

  • SHA256

    57670e593096256bace1389baa04c0df363f579fce821ff0753d05f065572b32

  • SHA512

    f5a87bdf013c8ff8d11e72dceb987faefd465411625339246c3db3bccd11e2a30f425319b3b95567ae528ab429604c7cfc02a722b76eee152c271a56f0920902

  • SSDEEP

    3072:l/i4ZL0n61v3bFLi3tuUawvWwO/UVD/gd+6FoddKRqybq39i3vb:lhLs61D83tuovWwOyrgdxF2y2M

Malware Config

Extracted

Family

stealc

C2

http://bernardofata.icu

Attributes
  • url_path

    /40d570f44e84a454.php

rc4.plain

Targets

    • Target

      57670e593096256bace1389baa04c0df363f579fce821ff0753d05f065572b32

    • Size

      291KB

    • MD5

      263b12572c3cbd3f3246e83830b483ea

    • SHA1

      0b41345bf0979f5c48a0106435b217baf7169a13

    • SHA256

      57670e593096256bace1389baa04c0df363f579fce821ff0753d05f065572b32

    • SHA512

      f5a87bdf013c8ff8d11e72dceb987faefd465411625339246c3db3bccd11e2a30f425319b3b95567ae528ab429604c7cfc02a722b76eee152c271a56f0920902

    • SSDEEP

      3072:l/i4ZL0n61v3bFLi3tuUawvWwO/UVD/gd+6FoddKRqybq39i3vb:lhLs61D83tuovWwOyrgdxF2y2M

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks