General
-
Target
443feeee0d3620715ba9238b805d35de.exe
-
Size
311KB
-
Sample
240428-d5w93sfe8w
-
MD5
443feeee0d3620715ba9238b805d35de
-
SHA1
2a8676095b811f57eb96066f58a296ae25ed062b
-
SHA256
b61de149a368f78dc76338a644958eb51d4efcd333b4e33485463c76f48fa1e2
-
SHA512
45a9bbee864a1d72e56ef5d50ba5817500dc39317d3c81de6e76da93545cd420cea66c5d6c9d9b0b90208ec60cc118a9007efc233e7bc5d6a2b3a91445106a45
-
SSDEEP
3072:x1KcGuj3Wp2C3AxPhx2+lz2JqO3Xk9drc0IbMSdVua0+us9pmo/R9MwWF9lzkkZD:RKcCQc0Ok9dcNbRrE+rMo/R9M1LJODE
Malware Config
Extracted
stealc
http://185.172.128.62
-
url_path
/902e53a07830e030.php
Targets
-
-
Target
443feeee0d3620715ba9238b805d35de.exe
-
Size
311KB
-
MD5
443feeee0d3620715ba9238b805d35de
-
SHA1
2a8676095b811f57eb96066f58a296ae25ed062b
-
SHA256
b61de149a368f78dc76338a644958eb51d4efcd333b4e33485463c76f48fa1e2
-
SHA512
45a9bbee864a1d72e56ef5d50ba5817500dc39317d3c81de6e76da93545cd420cea66c5d6c9d9b0b90208ec60cc118a9007efc233e7bc5d6a2b3a91445106a45
-
SSDEEP
3072:x1KcGuj3Wp2C3AxPhx2+lz2JqO3Xk9drc0IbMSdVua0+us9pmo/R9MwWF9lzkkZD:RKcCQc0Ok9dcNbRrE+rMo/R9M1LJODE
Score10/10-
Stealc
Stealc is an infostealer written in C++.
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-