General

  • Target

    c2743b008dc73aa0655b5034063be0227b2b17cc0d957b2d8139b934a2558d1f

  • Size

    274KB

  • Sample

    240505-p1h3faad4x

  • MD5

    160e4e93d93c4bc3147c16b4c63fe69e

  • SHA1

    7fcf95d878d7ab62eaee23b18c566bab137d28bc

  • SHA256

    c2743b008dc73aa0655b5034063be0227b2b17cc0d957b2d8139b934a2558d1f

  • SHA512

    7df14379844d0caf1adaaa25ee3d0605aca4f5fb7f85e080b51c06311e7e10e26cd569c17bb6e54542058092c6f748ccd646d500e41f7fef6f8a4248665b75a6

  • SSDEEP

    3072:UB44P4oz6x2fbTPV9bL4AM4DvyyUXffwf03o1Ep861jIa85pcrdK5emscAK65:m4oWcfbz/b0w6Xwf01HMa854JcAKw

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Targets

    • Target

      c2743b008dc73aa0655b5034063be0227b2b17cc0d957b2d8139b934a2558d1f

    • Size

      274KB

    • MD5

      160e4e93d93c4bc3147c16b4c63fe69e

    • SHA1

      7fcf95d878d7ab62eaee23b18c566bab137d28bc

    • SHA256

      c2743b008dc73aa0655b5034063be0227b2b17cc0d957b2d8139b934a2558d1f

    • SHA512

      7df14379844d0caf1adaaa25ee3d0605aca4f5fb7f85e080b51c06311e7e10e26cd569c17bb6e54542058092c6f748ccd646d500e41f7fef6f8a4248665b75a6

    • SSDEEP

      3072:UB44P4oz6x2fbTPV9bL4AM4DvyyUXffwf03o1Ep861jIa85pcrdK5emscAK65:m4oWcfbz/b0w6Xwf01HMa854JcAKw

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks