Overview

overview

10

Static

static

10

3c28d7d61f...a6.exe

windows7-x64

7

3c28d7d61f...a6.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    3c28d7d61f790a80c8d9f2a749bdc8f15aca88f0e73df8d17a285ef1fd293aa6.exe
  • Size 200KB
  • Sample240624-bgx6csscjc
  • SHA256 3c28d7d61f790a80c8d9f2a749bdc8f15aca88f0e73df8d17a285ef1fd293aa6
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
stealcvidar52d136f389bec064b9101e9cd85c51efdiscoveryspywarestealer

Malware Config

Extracted

Family

  • stealc

rc4.plain

Extracted

Family

  • vidar

Version

  • 9.7

Botnet

  • 52d136f389bec064b9101e9cd85c51ef

C2

  • https://steamcommunity.com/profiles/76561199686524322

  • https://t.me/k0mono

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1

Targets

    • Target
      3c28d7d61f790a80c8d9f2a749bdc8f15aca88f0e73df8d17a285ef1fd293aa6.exe
    • Size 200KB
    • SHA256 3c28d7d61f790a80c8d9f2a749bdc8f15aca88f0e73df8d17a285ef1fd293aa6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoveryspywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks