General

  • Target

    856bde816457bf38e182e2846df7c76e472e415c064f2698f4407733418e0363

  • Size

    308KB

  • Sample

    240427-1675asaa7w

  • MD5

    66bbed42cae06235280770421730efe0

  • SHA1

    61e90fe2ae74fd18fb27c9c9859ca7e05d0efb42

  • SHA256

    856bde816457bf38e182e2846df7c76e472e415c064f2698f4407733418e0363

  • SHA512

    6fd7fbfa9f2cb1a2af053bcdc1f9f16e1e853a1c04014955540b4d0dabbb0d313d0dd23c74df1fd89f1c09554dda4153eb5850b9c541fb4f0cb2914171280508

  • SSDEEP

    3072:6DeGTEjXp+rn2eC+Z8GXW0b8jO88jgc7qc6150say5gfsq4uFEt/wWF9ffPkkZcl:7grctQbsO88y50st5OD7EZ1Zyl

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.76

Attributes
  • url_path

    /8681490a59ad0e34.php

Targets

    • Target

      856bde816457bf38e182e2846df7c76e472e415c064f2698f4407733418e0363

    • Size

      308KB

    • MD5

      66bbed42cae06235280770421730efe0

    • SHA1

      61e90fe2ae74fd18fb27c9c9859ca7e05d0efb42

    • SHA256

      856bde816457bf38e182e2846df7c76e472e415c064f2698f4407733418e0363

    • SHA512

      6fd7fbfa9f2cb1a2af053bcdc1f9f16e1e853a1c04014955540b4d0dabbb0d313d0dd23c74df1fd89f1c09554dda4153eb5850b9c541fb4f0cb2914171280508

    • SSDEEP

      3072:6DeGTEjXp+rn2eC+Z8GXW0b8jO88jgc7qc6150say5gfsq4uFEt/wWF9ffPkkZcl:7grctQbsO88y50st5OD7EZ1Zyl

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Tasks