stealc

General

Target
file.exe
Size 2.0MB
Sample240129-rf5rtabeb8
SHA256 5e19860c1c39cd2f59baec1bf7e9ecef6894612bd90fd4a7418e051fab415ca9
MD5 e8c1d9e9dc777de306692212a00c1d64
SHA1 cd4479b8b3ab617c71b5f0c3cea45462578baac7
SHA512 2052fe1af88f3c22efc6e4b5bfd309dfcaeb50e5d9823ed330b9e1b8d65d5a4c8f4a5c7f28391faad3f251c162d70113cb5e39268e5cad9607cc5656e09fd6f6
SSDEEP 49152:ChQF2z0X1W34qvuyXPHcqaGqW9gwLgMyu5noEiyIJAuV:CeFdFWINS/NF9gpMR5oEfk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.79

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Targets

- Target
  file.exe
- Size 2.0MB
- SHA256 5e19860c1c39cd2f59baec1bf7e9ecef6894612bd90fd4a7418e051fab415ca9
- MD5 e8c1d9e9dc777de306692212a00c1d64
- SHA1 cd4479b8b3ab617c71b5f0c3cea45462578baac7
- SHA512 2052fe1af88f3c22efc6e4b5bfd309dfcaeb50e5d9823ed330b9e1b8d65d5a4c8f4a5c7f28391faad3f251c162d70113cb5e39268e5cad9607cc5656e09fd6f6
- SSDEEP 49152:ChQF2z0X1W34qvuyXPHcqaGqW9gwLgMyu5noEiyIJAuV:CeFdFWINS/NF9gpMR5oEfk
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

stealc discovery spyware stealer
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 25KB
- SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
- MD5 40d7eca32b2f4d29db98715dd45bfac5
- SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
- SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
- SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $TEMP/BroomSetup.exe
- Size 4.7MB
- SHA256 50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503
- MD5 5e94f0f6265f9e8b2f706f1d46bbd39e
- SHA1 d0189cba430f5eea07efe1ab4f89adf5ae2453db
- SHA512 473dfa66a36feed9b29a43245074141478327ce22ba7cce512599379dcb783b4d665e2d65c5e9750b988c7ed8f6c3349a7a12d4b8b57c89840eee6ca6e1a30cd
- SSDEEP 49152:90oSiZ63YBmS9+rCgpvH8la0ZxRh+caGnj8HEQUhexTUT+1d/2/Tbt:0Ula0cGwXUheabt
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6