General

  • Target

    f59e14113499cca08023515dd41a573f0d8aa6bd7b04295fa22ef2bcfdfccbf3.exe

  • Size

    310KB

  • Sample

    240111-y8wsyagge3

  • MD5

    c0a081ccb6d5f7c4aaeb4fc3028ff04f

  • SHA1

    86ac502e9511b857b8ea59f5d4667df466daebab

  • SHA256

    f59e14113499cca08023515dd41a573f0d8aa6bd7b04295fa22ef2bcfdfccbf3

  • SHA512

    1ccc5759c5345c375d5f3363e12c0242cd3981ac6e5444d88de4a7b5dd601cd3a0b757a796a1cac72d18fc8ca6fb1a7fa870fa6fc27bfbec9d8b71cdac510821

  • SSDEEP

    3072:HMnHLsm6aGIgdA+tZnpKMy1Vmu1HhBMu5RilDtPF:HWLBKZdbhyWu5hKuG5N

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.79

Attributes
  • url_path

    /3886d2276f6914c4.php

rc4.plain

Targets

    • Target

      f59e14113499cca08023515dd41a573f0d8aa6bd7b04295fa22ef2bcfdfccbf3.exe

    • Size

      310KB

    • MD5

      c0a081ccb6d5f7c4aaeb4fc3028ff04f

    • SHA1

      86ac502e9511b857b8ea59f5d4667df466daebab

    • SHA256

      f59e14113499cca08023515dd41a573f0d8aa6bd7b04295fa22ef2bcfdfccbf3

    • SHA512

      1ccc5759c5345c375d5f3363e12c0242cd3981ac6e5444d88de4a7b5dd601cd3a0b757a796a1cac72d18fc8ca6fb1a7fa870fa6fc27bfbec9d8b71cdac510821

    • SSDEEP

      3072:HMnHLsm6aGIgdA+tZnpKMy1Vmu1HhBMu5RilDtPF:HWLBKZdbhyWu5hKuG5N

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks