General

  • Target

    tmp

  • Size

    311KB

  • Sample

    240428-fkb5hsge85

  • MD5

    aed159d44da4c704179ec0932539f0d6

  • SHA1

    79951d01b3d08a9f0d78a4664cf6a14d2bd49cc3

  • SHA256

    af4eb9efd0598c707a5a1a443b3c41138141d056391494da2d81691d619aeb32

  • SHA512

    e19beed93b53b84ee2eee16a25ceb6a2a7f8342417861b14e1f8cf8bd0dcd6f6d7513d8ba204a8f7898ce708da29f385790aa82d3211ad7cb77a8e0fda3d877f

  • SSDEEP

    6144:usebxS9eUKfJyvHv24xXumlmcdTM1/JODE:utbxUeUGIPlxXumFURwE

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.62

Attributes
  • url_path

    /902e53a07830e030.php

Targets

    • Target

      tmp

    • Size

      311KB

    • MD5

      aed159d44da4c704179ec0932539f0d6

    • SHA1

      79951d01b3d08a9f0d78a4664cf6a14d2bd49cc3

    • SHA256

      af4eb9efd0598c707a5a1a443b3c41138141d056391494da2d81691d619aeb32

    • SHA512

      e19beed93b53b84ee2eee16a25ceb6a2a7f8342417861b14e1f8cf8bd0dcd6f6d7513d8ba204a8f7898ce708da29f385790aa82d3211ad7cb77a8e0fda3d877f

    • SSDEEP

      6144:usebxS9eUKfJyvHv24xXumlmcdTM1/JODE:utbxUeUGIPlxXumFURwE

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Tasks