Overview

overview

10

Static

static

1

app.html

windows10-2004-x64

10

app.html

windows11-21h2-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    app

  • Size

    542B

  • Sample

    240501-hbychacc62

  • MD5

    ecb096de4aa7a595b66aad7838cc5115

  • SHA1

    64f67c3b8d9cd794d473726e57497b8e8d0c52f1

  • SHA256

    74fafcc357a95cf19078b2489e9b8e8713cccf2b83398ae4c331a30bb9d87934

  • SHA512

    2f91f1842606c7e70db93c21cdf66ad7f88564a76887f51456dd845d022a88d746136b7074492cbfbde296c900b5358d273af33c5c47b6c5c718afbc9e85efb6

Score
10/10
hijackloaderrhadamanthysstealcdiscoveryloaderspywarestealertag:discovery AND tag:spyware AND tag:stealer

Malware Config

Extracted

Family

stealc

C2

http://89.105.198.116

Attributes
  • url_path

    /192e1934359966f8.php

Targets

    • Target

      app

    • Size

      542B

    • MD5

      ecb096de4aa7a595b66aad7838cc5115

    • SHA1

      64f67c3b8d9cd794d473726e57497b8e8d0c52f1

    • SHA256

      74fafcc357a95cf19078b2489e9b8e8713cccf2b83398ae4c331a30bb9d87934

    • SHA512

      2f91f1842606c7e70db93c21cdf66ad7f88564a76887f51456dd845d022a88d746136b7074492cbfbde296c900b5358d273af33c5c47b6c5c718afbc9e85efb6

    Score
    10/10
    hijackloaderrhadamanthysstealcdiscoveryloaderspywarestealertag:discovery AND tag:spyware AND tag:stealer

    • Detects HijackLoader (aka IDAT Loader)

    • HijackLoader

      HijackLoader is a multistage loader first seen in 2023.

      loaderhijackloader

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Executes dropped EXE

    • Loads dropped DLL

    • NSIS Integrity Check function

      Stealc Info Stealer.

      tag:discovery AND tag:spyware AND tag:stealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks