metastealer | 764a39a5533d4d34656154c80fc20a2bcab3e93901d00f158db335f30f5d0239 | Triage

Submit
Reports

Overview

overview

Static

static

3

764a39a553...39.dll

windows7-x64

764a39a553...39.dll

windows10-2004-x64

7

Sharing

General

Target

764a39a5533d4d34656154c80fc20a2bcab3e93901d00f158db335f30f5d0239
Size

4.2MB
Sample

240322-zt66ssgh54
MD5

73ec39ec810c866be4f7393b751df61f
SHA1

5b7851beeafabb79d4bac78b02e6ab9447193bcb
SHA256

764a39a5533d4d34656154c80fc20a2bcab3e93901d00f158db335f30f5d0239
SHA512

b99d86e9ebad49cbf13e29f3a6cef0e5366bfb4658246282c50a78cbc79e4d00bd63d57044f922ddf6eb80fdf8b6593336572c8036977bbd6a17468ae9b28b7f
SSDEEP

98304:Bsaj8qr2b4ETnwhvGPS2tDQOiFLe+ft7n27D24dW2H6911CPwDv3uFfJ8k:Bsag284uwFQjtUO6S+4rH6D1CPwDv3un

Score

10^/10

metastealer discovery motw phishing stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

764a39a5533d4d34656154c80fc20a2bcab3e93901d00f158db335f30f5d0239.dll

Resource

win7-20240221-en

metastealer discovery stealer

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

764a39a5533d4d34656154c80fc20a2bcab3e93901d00f158db335f30f5d0239.dll

Resource

win10v2004-20240226-en

discovery motw phishing

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  764a39a5533d4d34656154c80fc20a2bcab3e93901d00f158db335f30f5d0239
- Size
  
  4.2MB
- MD5
  
  73ec39ec810c866be4f7393b751df61f
- SHA1
  
  5b7851beeafabb79d4bac78b02e6ab9447193bcb
- SHA256
  
  764a39a5533d4d34656154c80fc20a2bcab3e93901d00f158db335f30f5d0239
- SHA512
  
  b99d86e9ebad49cbf13e29f3a6cef0e5366bfb4658246282c50a78cbc79e4d00bd63d57044f922ddf6eb80fdf8b6593336572c8036977bbd6a17468ae9b28b7f
- SSDEEP
  
  98304:Bsaj8qr2b4ETnwhvGPS2tDQOiFLe+ft7n27D24dW2H6911CPwDv3uFfJ8k:Bsag284uwFQjtUO6S+4rH6D1CPwDv3un
Score

10^/10

metastealer discovery stealer motw phishing
- Meta Stealer
  Meta Stealer steals passwords stored in browsers, written in C++.
  stealer metastealer
- MetaStealer payload
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metastealerdiscoverystealer

behavioral2

discoverymotwphishing

© 2018-2024

Terms | Privacy