General

  • Target

    47307dc63a88e7e1ba5eb0230a0ac39092bd5c284896909d5e9f274f47939483.exe

  • Size

    411KB

  • Sample

    240426-bjxmlsgg59

  • MD5

    74e9f3ba74c619021b87520b083c6a1d

  • SHA1

    72db70927e2be7ce030ecb812b9ea241b46d7ad0

  • SHA256

    47307dc63a88e7e1ba5eb0230a0ac39092bd5c284896909d5e9f274f47939483

  • SHA512

    1c8a4b3babdbedf0e9159c6a17e92ad5f1c9ae478d099771b2e775c40ea067cbfc4896d4847a58451484c5500c4df82a979562c944a4fff0c1bea15a841cf120

  • SSDEEP

    6144:I+x1ShTyz9EqOq21LVVb7ZpK2FoICp+fGqhDbSe8Lbp779ZLzW6Y:9xo2X2xV1ZpKJICpZqR2bdhc6Y

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.76

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Targets

    • Target

      47307dc63a88e7e1ba5eb0230a0ac39092bd5c284896909d5e9f274f47939483.exe

    • Size

      411KB

    • MD5

      74e9f3ba74c619021b87520b083c6a1d

    • SHA1

      72db70927e2be7ce030ecb812b9ea241b46d7ad0

    • SHA256

      47307dc63a88e7e1ba5eb0230a0ac39092bd5c284896909d5e9f274f47939483

    • SHA512

      1c8a4b3babdbedf0e9159c6a17e92ad5f1c9ae478d099771b2e775c40ea067cbfc4896d4847a58451484c5500c4df82a979562c944a4fff0c1bea15a841cf120

    • SSDEEP

      6144:I+x1ShTyz9EqOq21LVVb7ZpK2FoICp+fGqhDbSe8Lbp779ZLzW6Y:9xo2X2xV1ZpKJICpZqR2bdhc6Y

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks