General

  • Target

    4e08b9b37494a1917d2ab809fff59b3a45673a80d25587e51c8749331bb56233

  • Size

    275KB

  • Sample

    240506-fefkrahe9v

  • MD5

    31c1bdc2c9075e8c2eab9353c41c117f

  • SHA1

    ab28fb009dc8c2fa244c773760109e38711b1025

  • SHA256

    4e08b9b37494a1917d2ab809fff59b3a45673a80d25587e51c8749331bb56233

  • SHA512

    78b995611e33b441e9ebaeecbbce3ec96bbfcac7f71bd0f639ab1e3394900be5c80893dfc8957b696609eca7ce1933d58f026c7be389795f0dcc72ad3fc35593

  • SSDEEP

    6144:u7mMXatbEfVijJvYwGRFZDvh81Q1xVN6a:u73XatbrxYwGVxVN6

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Targets

    • Target

      4e08b9b37494a1917d2ab809fff59b3a45673a80d25587e51c8749331bb56233

    • Size

      275KB

    • MD5

      31c1bdc2c9075e8c2eab9353c41c117f

    • SHA1

      ab28fb009dc8c2fa244c773760109e38711b1025

    • SHA256

      4e08b9b37494a1917d2ab809fff59b3a45673a80d25587e51c8749331bb56233

    • SHA512

      78b995611e33b441e9ebaeecbbce3ec96bbfcac7f71bd0f639ab1e3394900be5c80893dfc8957b696609eca7ce1933d58f026c7be389795f0dcc72ad3fc35593

    • SSDEEP

      6144:u7mMXatbEfVijJvYwGRFZDvh81Q1xVN6a:u73XatbrxYwGVxVN6

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks