Overview

overview

10

Static

static

7

ff3bd8bcbd...4d.exe

windows7-x64

10

ff3bd8bcbd...4d.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ff3bd8bcbd9f93c0b48fac3dad59735db9db2343da3126bc836a3134b563924d.zip

  • Size

    793KB

  • Sample

    231223-jv5rcshaf8

  • MD5

    ac3ed992282cdeb627b6a9bff366c00e

  • SHA1

    ee74af8052e20a9539f24e508e215be6f2a71220

  • SHA256

    80757a5329296c6a9a35f0a6ae616a0d05747e48b29f82aba9e3fd0ec4403fad

  • SHA512

    b25bbc19ed2d941a592fa0e995119c77acdccc98c67f7cd8d95e236694ffab9962620b75d8657b3d781423ddb6bf9ac85a081a8920798eb148e0bea23f2893b8

  • SSDEEP

    24576:VE/DjxxziKIVcHBV0J2fwrNpYsZ8GUx8KqR:ozIiHBxfwrNpHLUOB

Score
10/10
gluptebastealcdropperevasionloaderstealerupx

Malware Config

Extracted

Family

stealc

C2

http://77.91.76.36

Attributes
  • url_path

    /3886d2276f6914c4.php

rc4.plain

Targets

    • Target

      ff3bd8bcbd9f93c0b48fac3dad59735db9db2343da3126bc836a3134b563924d.exe

    • Size

      799KB

    • MD5

      bb7917ed8063b9fd1cf3ea57fed87a5a

    • SHA1

      d98d8b5f5577f9d46cbcc3b73774ab3bc57e2466

    • SHA256

      ff3bd8bcbd9f93c0b48fac3dad59735db9db2343da3126bc836a3134b563924d

    • SHA512

      426c1a336748a16532e8c8d070eee8127b23a49fc9e9647af4b785fcf9930bf98bc4d4641fb1e595165e3abc85a4b24a2f3a6a956dd7be7b291fd05d33ef0677

    • SSDEEP

      24576:p9cSTsqZCHEOKCy0aTrhw53Kd70sc1QEz:p9cSTZCHvK/agR0hz

    Score
    10/10
    stealcevasionstealerupxgluptebadropperloader

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks