Overview

overview

10

Static

static

10

5aa49622f3...68.exe

windows7-x64

10

5aa49622f3...68.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5aa49622f3dafc184f903b7b78a2fd68.exe
  • Size 8.4MB
  • Sample240507-matedaed84
  • SHA256 285493c54c35e3b571e28fc0816baa4b3833329eeec3649601dd6385a60c8d84
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
hijackloaderstealcloaderspywarestealer

Malware Config

Extracted

Family

  • stealc

C2

  • http://193.163.7.82

Attributes
  • url_path

    /722c81812703a73d.php

Targets

    • Target
      5aa49622f3dafc184f903b7b78a2fd68.exe
    • Size 8.4MB
    • SHA256 285493c54c35e3b571e28fc0816baa4b3833329eeec3649601dd6385a60c8d84
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    hijackloaderstealcloaderspywarestealer

    • Detects HijackLoader (aka IDAT Loader)

    • HijackLoader

      HijackLoader is a multistage loader first seen in 2023.

      loaderhijackloader

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Downloads MZ/PE file

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks