General

  • Target

    34c0942de85e9d78be772fc132b27288.bin

  • Size

    152KB

  • Sample

    240105-bqp64sfccl

  • MD5

    47de82bf3a8a7101e8cb567397da83c0

  • SHA1

    cfcd6a3ba2dd7c2e3330cf4b09c28edf10dd0c1e

  • SHA256

    ee08ae63154ef53e49d6423e609991a1174310cad26278c9a5d0ed7c55295c05

  • SHA512

    449ff74065e75ccd22d5be5ebe525c3b47fa1a69bee0ed1876b4c2b5eb94592529124cc02984989aaf7831cea21454ff71f8bc11a784d20d48e0389ed0bff9b3

  • SSDEEP

    3072:jPNaHVNyZHNqrMVga3y0SW/rHTSsZsdjopHAEoQCQeZNNI91d:5eVNYNqrSgagW/rzlqdjopHAErCna1

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.79

Attributes
  • url_path

    /3886d2276f6914c4.php

rc4.plain

Targets

    • Target

      76f5084bca22085b3c76484470899bcb77f86d41208d354cacd8129f0b464b00.exe

    • Size

      240KB

    • MD5

      34c0942de85e9d78be772fc132b27288

    • SHA1

      84a62b658ac354d128b3063d8f4dd009fca19066

    • SHA256

      76f5084bca22085b3c76484470899bcb77f86d41208d354cacd8129f0b464b00

    • SHA512

      e1145327d08724427eb3df705b8ea63c10123ea461de0f1694d2dd007f33dd617e57569e90c484f82b1b41dfda138bed75632f69b2357fdb7d9ac905d81e4a0d

    • SSDEEP

      3072:PfULUw/ete5U+oXT0vHxNnQmaNyKqrykIbghLwgeRp:PfULzOei+oQ/xqmkDvQUge

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks