General
-
Target
a41c93f1f584aee3a5e1ebd9f197a119a8e6bceabe2bbbd4d3e922aee12f6431
-
Size
347KB
-
Sample
240429-tzjd2afe5z
-
MD5
b6516621eb8e71838afaffe1a06c88cb
-
SHA1
dd58301bf4f7ae30a48f81051e84ba2b481c1ba8
-
SHA256
a41c93f1f584aee3a5e1ebd9f197a119a8e6bceabe2bbbd4d3e922aee12f6431
-
SHA512
c598690e4a4edd459e05c62b76deadcaee83a7a64c996c6393b308fb75bb9e212b4f88bf11040c5c60926545336c4054c9e0f7c84f90727b44455c6e7e43e8ee
-
SSDEEP
6144:b4ZQNIo0QKjHUGwo2ve4u5b85/k1sZtl8OguSDU4pt3hdno/:boQNUQ+HUGj2v4981MsXl87uSDU4pe/
Static task
static1
Behavioral task
behavioral1
Sample
a41c93f1f584aee3a5e1ebd9f197a119a8e6bceabe2bbbd4d3e922aee12f6431.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a41c93f1f584aee3a5e1ebd9f197a119a8e6bceabe2bbbd4d3e922aee12f6431.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
stealc
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Targets
-
-
Target
a41c93f1f584aee3a5e1ebd9f197a119a8e6bceabe2bbbd4d3e922aee12f6431
-
Size
347KB
-
MD5
b6516621eb8e71838afaffe1a06c88cb
-
SHA1
dd58301bf4f7ae30a48f81051e84ba2b481c1ba8
-
SHA256
a41c93f1f584aee3a5e1ebd9f197a119a8e6bceabe2bbbd4d3e922aee12f6431
-
SHA512
c598690e4a4edd459e05c62b76deadcaee83a7a64c996c6393b308fb75bb9e212b4f88bf11040c5c60926545336c4054c9e0f7c84f90727b44455c6e7e43e8ee
-
SSDEEP
6144:b4ZQNIo0QKjHUGwo2ve4u5b85/k1sZtl8OguSDU4pt3hdno/:boQNUQ+HUGj2v4981MsXl87uSDU4pe/
-
SectopRAT payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-