General
-
Target
db4defb73e7393df8472a1133abbdd60ac42a9ca063cf0e2c9eb7c2760eddc32.exe
-
Size
204KB
-
Sample
240428-cjcswaeb91
-
MD5
095481b86d31bf49a325d3e98d2dc476
-
SHA1
1a7dec1679e716bb9635a1d92e27a20184d5ef61
-
SHA256
db4defb73e7393df8472a1133abbdd60ac42a9ca063cf0e2c9eb7c2760eddc32
-
SHA512
5e6a376ee0b6d8d3b606f5b44081d8b46ae3f2a2d02116dde7187cf7771d65ecafee9396ac146113d5843e7b371053ab5699665ed6bc4ee054b84481f37b771c
-
SSDEEP
3072:NXEpXDn/MZE8ZphnfBPXh9Wt/YmeWUG52TGE7oUODDQ2:NXEpTnkO8ZvNhUtgm0NTG8RODDQ
Malware Config
Extracted
stealc
http://185.172.128.76
-
url_path
/8681490a59ad0e34.php
Targets
-
-
Target
db4defb73e7393df8472a1133abbdd60ac42a9ca063cf0e2c9eb7c2760eddc32.exe
-
Size
204KB
-
MD5
095481b86d31bf49a325d3e98d2dc476
-
SHA1
1a7dec1679e716bb9635a1d92e27a20184d5ef61
-
SHA256
db4defb73e7393df8472a1133abbdd60ac42a9ca063cf0e2c9eb7c2760eddc32
-
SHA512
5e6a376ee0b6d8d3b606f5b44081d8b46ae3f2a2d02116dde7187cf7771d65ecafee9396ac146113d5843e7b371053ab5699665ed6bc4ee054b84481f37b771c
-
SSDEEP
3072:NXEpXDn/MZE8ZphnfBPXh9Wt/YmeWUG52TGE7oUODDQ2:NXEpTnkO8ZvNhUtgm0NTG8RODDQ
Score10/10-
Stealc
Stealc is an infostealer written in C++.
-
Detect binaries embedding considerable number of MFA browser extension IDs.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-