stealc

Sharing

Copy URL

Twitter E-mail

General

Target

27bcef83c229a331655d6ed79bfb705976955b27e85e2cdd4dae479cc116d053
Size

2.0MB
Sample

240312-3b77xsea4z
MD5

e047079575fc4b4d0e98bdb8d5e8c67b
SHA1

4ade59737e7270d3bc3b68c62763936069403f81
SHA256

27bcef83c229a331655d6ed79bfb705976955b27e85e2cdd4dae479cc116d053
SHA512

9859d6868232e71b3de2a3b61dc258b86b40460dc42ad38f288dc313bcc0be16e1231abbcaa134f9ffc8e5edf51b5577b31e296f135c35f916efc55ee74a9104
SSDEEP

49152:LXm5ahPlga4jo+WRR0g2OFDcnHaefttJmiNzRsuP:Dm5U9X5TMg2A8BttYi9P

Score

10^/10

Malware Config

Extracted

Family

stealc

http://185.172.128.145

Attributes

url_path
/3cd2b41cbde8fc9c.php

Targets

- Target
  
  27bcef83c229a331655d6ed79bfb705976955b27e85e2cdd4dae479cc116d053
- Size
  
  2.0MB
- MD5
  
  e047079575fc4b4d0e98bdb8d5e8c67b
- SHA1
  
  4ade59737e7270d3bc3b68c62763936069403f81
- SHA256
  
  27bcef83c229a331655d6ed79bfb705976955b27e85e2cdd4dae479cc116d053
- SHA512
  
  9859d6868232e71b3de2a3b61dc258b86b40460dc42ad38f288dc313bcc0be16e1231abbcaa134f9ffc8e5edf51b5577b31e296f135c35f916efc55ee74a9104
- SSDEEP
  
  49152:LXm5ahPlga4jo+WRR0g2OFDcnHaefttJmiNzRsuP:Dm5U9X5TMg2A8BttYi9P
Score

10^/10

stealc discovery persistence spyware stealer upx
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/INetC.dll
- Size
  
  21KB
- MD5
  
  2b342079303895c50af8040a91f30f71
- SHA1
  
  b11335e1cb8356d9c337cb89fe81d669a69de17e
- SHA256
  
  2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
- SHA512
  
  550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
- SSDEEP
  
  384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
Score

3^/10
behavioral3 behavioral4
- Target
  
  $TEMP/BroomSetup.exe
- Size
  
  1.7MB
- MD5
  
  eee5ddcffbed16222cac0a1b4e2e466e
- SHA1
  
  28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5
- SHA256
  
  2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
- SHA512
  
  8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc
- SSDEEP
  
  49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  
  $TEMP/syncUpd.exe
- Size
  
  200KB
- MD5
  
  c722591f624fb69970f246b8c81d830f
- SHA1
  
  85516decea5d6987bebe39cbadf36053beaf4bb0
- SHA256
  
  13cd1152a19fdac6581cac2bd822f34bd3026ea1783ff231e299b6d28c046a6a
- SHA512
  
  822584c5c8a0813af4d845e80919776c71a43464ab719d1c303ebaae6a8ed47763183566bedc9be2e8c44de8ee6fd62d1e12be471e5d5c73ae4b1dcdaa34a908
- SSDEEP
  
  3072:8PDOu5suCmavnBRsuP6GTdbB27zP6FtHPUxX1GOL3+:455zaPBRPPj27uPH8jzu
Score

10^/10

stealc discovery persistence spyware stealer
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral7 behavioral8