metastealer | 79d7036b030dcaaec258637b01dbc4f9786d6777afe85f6fe397d6034e2f4806 | Triage

Sharing

General

Target

79d7036b030dcaaec258637b01dbc4f9786d6777afe85f6fe397d6034e2f4806.vhd
Size

20.0MB
Sample

240705-rsdh4asdrd
MD5

e004a8e64e2ea84f14932a6e1a1d66c1
SHA1

b0dd61517b0234b83ad5f6127128b80ebe53a4cf
SHA256

79d7036b030dcaaec258637b01dbc4f9786d6777afe85f6fe397d6034e2f4806
SHA512

4b057be2e7b1b12b24378f606ca948101c83387d42ad6d91a2799b4771592eaa6c594b1b02616ee719c93d774507f8346bbef0b4d81616c686cdcc24a8b8bb29
SSDEEP

98304:2s+uXh7LUq17TWdDFtEUx61CPwDv3uFfJx:2s+ch7pWdDFKUx61CPwDv3uFfJx

Score

10^/10

metastealer discovery execution spyware stealer

Malware Config

Extracted

Family

metastealer

C2

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Targets

- Target
  
  Untitled_June_06_25_2024_export.pdf.pif
- Size
  
  801KB
- MD5
  
  41dcc29d7eaba7b84fd54323394712af
- SHA1
  
  ddc0100723cc2dc9ae8b02a0cb7fe4a86c02d54b
- SHA256
  
  a909bef708a47ae428fedbc566132c56f15ae7511dc460cf22055ec1a72d485a
- SHA512
  
  5a3e8c1eda558e0b90470d752490bc4d04610f93e453cbfd9013a363cfdf5e607974d526c49efe2ef0440e241d775b66bd7c48c74ee9e8677a37cdedc30c42ee
- SSDEEP
  
  6144:xmbuKA33X1rgMuu+xdaXkW+zF6m8XZPELSrPzA:x6XA33X1rTuuyrVZ6m8XGH
Score

10^/10

metastealer discovery execution spyware stealer
- Meta Stealer
  Meta Stealer steals passwords stored in browsers, written in C++.
  stealer metastealer
- MetaStealer payload
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metastealerdiscoveryexecutionspywarestealer

behavioral2

metastealerdiscoveryexecutionspywarestealer