stealc

Sharing

Copy URL

Twitter E-mail

General

Target

bdc7ffeef3b5a1883c2436061a2c1500bebe3351c53fdd08363b0a8a6688c875
Size

2.0MB
Sample

240313-a3zqmsfg2x
MD5

349ba3d1c0e6137a949e7e987613f847
SHA1

bd497597228a48d1974a154ec9643d1e8bce02e2
SHA256

bdc7ffeef3b5a1883c2436061a2c1500bebe3351c53fdd08363b0a8a6688c875
SHA512

668a3333b3b7455c2eee799ae6b3b76c3dcd6887a5d6f33d6318b7c076e980dd4f0e2bad61467ebf29120c1284bd483b3a6772140cd4390016e6450793fa6417
SSDEEP

49152:LCfuk7QR6Bi93ljOw3ipad4NF27EVYsXpbsE2ywndWWc2j4tkjW33:GER6kPjOgipaU2QVhXpbLmzc2jXS

Score

10^/10

Malware Config

Extracted

Family

stealc

http://185.172.128.145

Attributes

url_path
/3cd2b41cbde8fc9c.php

Targets

- Target
  
  bdc7ffeef3b5a1883c2436061a2c1500bebe3351c53fdd08363b0a8a6688c875
- Size
  
  2.0MB
- MD5
  
  349ba3d1c0e6137a949e7e987613f847
- SHA1
  
  bd497597228a48d1974a154ec9643d1e8bce02e2
- SHA256
  
  bdc7ffeef3b5a1883c2436061a2c1500bebe3351c53fdd08363b0a8a6688c875
- SHA512
  
  668a3333b3b7455c2eee799ae6b3b76c3dcd6887a5d6f33d6318b7c076e980dd4f0e2bad61467ebf29120c1284bd483b3a6772140cd4390016e6450793fa6417
- SSDEEP
  
  49152:LCfuk7QR6Bi93ljOw3ipad4NF27EVYsXpbsE2ywndWWc2j4tkjW33:GER6kPjOgipaU2QVhXpbLmzc2jXS
Score

10^/10

stealc discovery persistence spyware stealer upx
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/INetC.dll
- Size
  
  21KB
- MD5
  
  2b342079303895c50af8040a91f30f71
- SHA1
  
  b11335e1cb8356d9c337cb89fe81d669a69de17e
- SHA256
  
  2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
- SHA512
  
  550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
- SSDEEP
  
  384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
Score

3^/10
behavioral3 behavioral4
- Target
  
  $TEMP/BroomSetup.exe
- Size
  
  1.7MB
- MD5
  
  eee5ddcffbed16222cac0a1b4e2e466e
- SHA1
  
  28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5
- SHA256
  
  2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
- SHA512
  
  8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc
- SSDEEP
  
  49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  
  $TEMP/syncUpd.exe
- Size
  
  200KB
- MD5
  
  c722591f624fb69970f246b8c81d830f
- SHA1
  
  85516decea5d6987bebe39cbadf36053beaf4bb0
- SHA256
  
  13cd1152a19fdac6581cac2bd822f34bd3026ea1783ff231e299b6d28c046a6a
- SHA512
  
  822584c5c8a0813af4d845e80919776c71a43464ab719d1c303ebaae6a8ed47763183566bedc9be2e8c44de8ee6fd62d1e12be471e5d5c73ae4b1dcdaa34a908
- SSDEEP
  
  3072:8PDOu5suCmavnBRsuP6GTdbB27zP6FtHPUxX1GOL3+:455zaPBRPPj27uPH8jzu
Score

10^/10

stealc discovery persistence spyware stealer
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral7 behavioral8