stealc

General

Target
1e626e896e2859ebd0d240dfec7939b1.exe
Size 1.8MB
Sample240222-te21msca7s
SHA256 d9e2872d558721de5b09602fe211b1d5f8b53dd69537b4553bf536fd08feee61
MD5 1e626e896e2859ebd0d240dfec7939b1
SHA1 735d93eb4c231ba0675c62ea49b88f61ea9fb3cb
SHA512 1329e4ba3551e29720d99954426cfd9b0e03e902ed5b7f94ac2eb239ef5259062f3308cec427322c1532bf7117e1b0e2f35fbb4f6b16149267d641eb237ecf74
SSDEEP 24576:sPdCquy2+Q97+0CnnNjeGXkBXwp7Ufvrz0I5j2sMfqjZk8jbHt/4X1vyZw4WULH:Uq796HIWiDP5j2sMfqe8jF+yRH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.145

Attributes

url_path
/3cd2b41cbde8fc9c.php

Targets

- Target
  1e626e896e2859ebd0d240dfec7939b1.exe
- Size 1.8MB
- SHA256 d9e2872d558721de5b09602fe211b1d5f8b53dd69537b4553bf536fd08feee61
- MD5 1e626e896e2859ebd0d240dfec7939b1
- SHA1 735d93eb4c231ba0675c62ea49b88f61ea9fb3cb
- SHA512 1329e4ba3551e29720d99954426cfd9b0e03e902ed5b7f94ac2eb239ef5259062f3308cec427322c1532bf7117e1b0e2f35fbb4f6b16149267d641eb237ecf74
- SSDEEP 24576:sPdCquy2+Q97+0CnnNjeGXkBXwp7Ufvrz0I5j2sMfqjZk8jbHt/4X1vyZw4WULH:Uq796HIWiDP5j2sMfqe8jF+yRH
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

stealc discovery spyware stealer
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 25KB
- SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
- MD5 40d7eca32b2f4d29db98715dd45bfac5
- SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
- SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
- SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $TEMP/BroomSetup.exe
- Size 4.7MB
- SHA256 50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503
- MD5 5e94f0f6265f9e8b2f706f1d46bbd39e
- SHA1 d0189cba430f5eea07efe1ab4f89adf5ae2453db
- SHA512 473dfa66a36feed9b29a43245074141478327ce22ba7cce512599379dcb783b4d665e2d65c5e9750b988c7ed8f6c3349a7a12d4b8b57c89840eee6ca6e1a30cd
- SSDEEP 49152:90oSiZ63YBmS9+rCgpvH8la0ZxRh+caGnj8HEQUhexTUT+1d/2/Tbt:0Ula0cGwXUheabt
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6