stealc

Sharing

Copy URL Twitter E-mail

General

Target
671fc7acb0f580ff3a30e09ebeee1e3205aa9a446f75616b542fbd0a3aa1b120
Size 2.0MB
Sample240312-xvcbpsbb37
SHA256 671fc7acb0f580ff3a30e09ebeee1e3205aa9a446f75616b542fbd0a3aa1b120
MD5 0f115f24c7465cfa6a1679b3464f5771
SHA1 131e8238bd8605714add657992ba6efdaf424604
SHA512 0ec11d304004729c9493d847123e947beeb0ef1e4c5268ea542e36b247e958effb4f847baacecb444dd3bba507e455a5f621c0ee23fc8cedf0736a351832ad28
SSDEEP 49152:LtM+Cjo7TVrVH/qinqKgGOpa2PGLN2/5bsPwWFVICIEGxMa27:C+/VrcoqK06vwEV2rQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

stealc

http://185.172.128.145

Attributes

url_path
/3cd2b41cbde8fc9c.php

Targets

- Target
  671fc7acb0f580ff3a30e09ebeee1e3205aa9a446f75616b542fbd0a3aa1b120
- Size 2.0MB
- SHA256 671fc7acb0f580ff3a30e09ebeee1e3205aa9a446f75616b542fbd0a3aa1b120
- MD5 0f115f24c7465cfa6a1679b3464f5771
- SHA1 131e8238bd8605714add657992ba6efdaf424604
- SHA512 0ec11d304004729c9493d847123e947beeb0ef1e4c5268ea542e36b247e958effb4f847baacecb444dd3bba507e455a5f621c0ee23fc8cedf0736a351832ad28
- SSDEEP 49152:LtM+Cjo7TVrVH/qinqKgGOpa2PGLN2/5bsPwWFVICIEGxMa27:C+/VrcoqK06vwEV2rQ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

stealc discovery persistence spyware stealer upx
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 21KB
- SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
- MD5 2b342079303895c50af8040a91f30f71
- SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
- SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
- SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $TEMP/BroomSetup.exe
- Size 1.7MB
- SHA256 2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
- MD5 eee5ddcffbed16222cac0a1b4e2e466e
- SHA1 28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5
- SHA512 8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc
- SSDEEP 49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  $TEMP/syncUpd.exe
- Size 200KB
- SHA256 2b26a0dac779643189180d9e50ace8e299c5487a9a8cdaf4300cc64a9d674b33
- MD5 11a8185b4885be3b627a0231d08719ae
- SHA1 8b18353b7a52d66e4a868e4d12a21a0533fa0ee0
- SHA512 091c82a9063b5371cc5d35e51dc73c956160477d0293137ae14fa4a7ec70ddc68a2dbd8601bbb8a80636b793c0e53b0887674a6bf3c383354d8722af083a4d6b
- SSDEEP 3072:pHOLgO34PMRjf0jtAV+vQoCNJpuumeuG3BYBI3PuHhCadEZE+:pEg8RIOVboCZuAwW
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

stealc discovery persistence spyware stealer
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral7 behavioral8