General
-
Target
26a77a61fb964d82c815da952ebedb23.exe
-
Size
2.4MB
-
Sample
240625-bf3pfsvgnp
-
MD5
26a77a61fb964d82c815da952ebedb23
-
SHA1
8d9100fcc2e55df7c20954d459c1a6c5861228a1
-
SHA256
2e1662bc8b93a8cea652f916afa628ce5646e3b62d15cf584188f7df066dca73
-
SHA512
793a6dcd9d3eae88b25a24895f0cf2b23060e8b59788b0bbf357a8fd7df0f536301912dcdd8c2ccf08313f89322a350c5bbc0bdce08a44bedd862cf8d421ab9a
-
SSDEEP
49152:6ia4dCxGEzut9XYlu2fFNwLTxiYumd7Q/BFEUS2NbUd2Tb1:fKEEze9Uu2f8/cLmdcPSqbUdch
Static task
static1
Behavioral task
behavioral1
Sample
26a77a61fb964d82c815da952ebedb23.exe
Resource
win7-20240221-en
Malware Config
Extracted
stealc
default
http://85.28.47.4
-
url_path
/920475a59bac849d.php
Targets
-
-
Target
26a77a61fb964d82c815da952ebedb23.exe
-
Size
2.4MB
-
MD5
26a77a61fb964d82c815da952ebedb23
-
SHA1
8d9100fcc2e55df7c20954d459c1a6c5861228a1
-
SHA256
2e1662bc8b93a8cea652f916afa628ce5646e3b62d15cf584188f7df066dca73
-
SHA512
793a6dcd9d3eae88b25a24895f0cf2b23060e8b59788b0bbf357a8fd7df0f536301912dcdd8c2ccf08313f89322a350c5bbc0bdce08a44bedd862cf8d421ab9a
-
SSDEEP
49152:6ia4dCxGEzut9XYlu2fFNwLTxiYumd7Q/BFEUS2NbUd2Tb1:fKEEze9Uu2f8/cLmdcPSqbUdch
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-