General

  • Target

    1f0b75f4b09716360b4690cbc23071f6e356c8379081bfeb380094cdd39585f8

  • Size

    449KB

  • Sample

    240429-fhgxzsbc4x

  • MD5

    322bccfb2d25935cf3517bad1b4247b0

  • SHA1

    d956f215c9222230d3c49868139a0aa996c389ba

  • SHA256

    1f0b75f4b09716360b4690cbc23071f6e356c8379081bfeb380094cdd39585f8

  • SHA512

    713cbe23e39d56559569fd3cc78fc0a6a8aa6a2c4a01934777d3564dd778364dfde544af144e5751b2db59829d4198cc10ae3dbb7477cba9d6503824eb50aba6

  • SSDEEP

    12288:Gb9GpjRN3YUOlgHCmVgNZM4bqkQAXHYK:Xjf3YUOeO7BFTHY

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.151

Attributes
  • url_path

    /7043a0c6a68d9c65.php

Targets

    • Target

      1f0b75f4b09716360b4690cbc23071f6e356c8379081bfeb380094cdd39585f8

    • Size

      449KB

    • MD5

      322bccfb2d25935cf3517bad1b4247b0

    • SHA1

      d956f215c9222230d3c49868139a0aa996c389ba

    • SHA256

      1f0b75f4b09716360b4690cbc23071f6e356c8379081bfeb380094cdd39585f8

    • SHA512

      713cbe23e39d56559569fd3cc78fc0a6a8aa6a2c4a01934777d3564dd778364dfde544af144e5751b2db59829d4198cc10ae3dbb7477cba9d6503824eb50aba6

    • SSDEEP

      12288:Gb9GpjRN3YUOlgHCmVgNZM4bqkQAXHYK:Xjf3YUOeO7BFTHY

    • Detects Arechclient2 RAT

      Arechclient2.

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks