General
-
Target
7e5a8473b286dfbf9e962506594832f4.exe
-
Size
451KB
-
Sample
240429-fkntbabd3z
-
MD5
7e5a8473b286dfbf9e962506594832f4
-
SHA1
e64dbd3599e663b6c92d2c1cda6b1c520a66cf00
-
SHA256
f1ecf2469a831081ce9d895a7f1fde88e882e2c96b4c96bbea2f3c622786ffdc
-
SHA512
b35987e850e5ea30551e83798cb02946bbcea506d771fbd70ce4fd95035e2ba50f32babb3b4a03c9c94079ee91f076401678820d89d5dacf9dd31e8a9b4b5564
-
SSDEEP
12288:Dt++0WACRaBnCQ08O0y+li0pUIZ53+gXWN1RU:ihC1gp+Qk1RU
Static task
static1
Behavioral task
behavioral1
Sample
7e5a8473b286dfbf9e962506594832f4.exe
Resource
win7-20240220-en
Malware Config
Extracted
stealc
http://185.172.128.151
-
url_path
/7043a0c6a68d9c65.php
Targets
-
-
Target
7e5a8473b286dfbf9e962506594832f4.exe
-
Size
451KB
-
MD5
7e5a8473b286dfbf9e962506594832f4
-
SHA1
e64dbd3599e663b6c92d2c1cda6b1c520a66cf00
-
SHA256
f1ecf2469a831081ce9d895a7f1fde88e882e2c96b4c96bbea2f3c622786ffdc
-
SHA512
b35987e850e5ea30551e83798cb02946bbcea506d771fbd70ce4fd95035e2ba50f32babb3b4a03c9c94079ee91f076401678820d89d5dacf9dd31e8a9b4b5564
-
SSDEEP
12288:Dt++0WACRaBnCQ08O0y+li0pUIZ53+gXWN1RU:ihC1gp+Qk1RU
-
SectopRAT payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-