stealc

Sharing

Copy URL Twitter E-mail

General

Target
59206d63b916e688224ac1152c0c1432668d9dd17cd47911d9a05099cb7d3fbe
Size 2.0MB
Sample240313-a17cpshe84
SHA256 59206d63b916e688224ac1152c0c1432668d9dd17cd47911d9a05099cb7d3fbe
MD5 d3aa7ddee60be65878f306b4310485a7
SHA1 a0e46e49f8d2561456d45cf9d59a9771749992f7
SHA512 35e6626d64f03a587975296e6cf820cf2d75cb051800e5a6948f3c08a2b98700c660c33892f63eef3c00618a95bfa7a25acba268bda98ea5ecc5dd561bc329f9
SSDEEP 49152:LaKkiWwW3oTlF561z6BnQiUHlSIkK/dkMOIO8KtRsxuwPwJ:GKBVGoZ62QlmM7O8yRsxuwo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

stealc

http://185.172.128.145

Attributes

url_path
/3cd2b41cbde8fc9c.php

Targets

- Target
  59206d63b916e688224ac1152c0c1432668d9dd17cd47911d9a05099cb7d3fbe
- Size 2.0MB
- SHA256 59206d63b916e688224ac1152c0c1432668d9dd17cd47911d9a05099cb7d3fbe
- MD5 d3aa7ddee60be65878f306b4310485a7
- SHA1 a0e46e49f8d2561456d45cf9d59a9771749992f7
- SHA512 35e6626d64f03a587975296e6cf820cf2d75cb051800e5a6948f3c08a2b98700c660c33892f63eef3c00618a95bfa7a25acba268bda98ea5ecc5dd561bc329f9
- SSDEEP 49152:LaKkiWwW3oTlF561z6BnQiUHlSIkK/dkMOIO8KtRsxuwPwJ:GKBVGoZ62QlmM7O8yRsxuwo
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

stealc discovery persistence spyware stealer upx
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 21KB
- SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
- MD5 2b342079303895c50af8040a91f30f71
- SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
- SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
- SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $TEMP/BroomSetup.exe
- Size 1.7MB
- SHA256 2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
- MD5 eee5ddcffbed16222cac0a1b4e2e466e
- SHA1 28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5
- SHA512 8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc
- SSDEEP 49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  $TEMP/syncUpd.exe
- Size 200KB
- SHA256 13cd1152a19fdac6581cac2bd822f34bd3026ea1783ff231e299b6d28c046a6a
- MD5 c722591f624fb69970f246b8c81d830f
- SHA1 85516decea5d6987bebe39cbadf36053beaf4bb0
- SHA512 822584c5c8a0813af4d845e80919776c71a43464ab719d1c303ebaae6a8ed47763183566bedc9be2e8c44de8ee6fd62d1e12be471e5d5c73ae4b1dcdaa34a908
- SSDEEP 3072:8PDOu5suCmavnBRsuP6GTdbB27zP6FtHPUxX1GOL3+:455zaPBRPPj27uPH8jzu
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

stealc discovery persistence spyware stealer
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral7 behavioral8