metastealer | 9e66b24bcd51c982b74f7b8cbc3eea09fca7997878c48a4ff4eb6842bc32614d | Triage

Sharing

General

Target

zvr167lpus.rar
Size

2.0MB
Sample

240705-rwxq5szfkm
MD5

54bd7f044184f3f1976ae7ab5c88f98c
SHA1

ea39be3f3cef3f1d2e20bbecfb7a6efc943ab42e
SHA256

9e66b24bcd51c982b74f7b8cbc3eea09fca7997878c48a4ff4eb6842bc32614d
SHA512

cb9f786077107452ce73a58fb21bdd65064728d754da032caa051829140d875a345c928a91911b544283a6f26c661550cdc3d3fb3df263b5bd9d0c8c7971a71c
SSDEEP

49152:xnQ2zixqnpaHVGU3zknb9iilWHtaYXLQcoNhE6Biz:FZYqpm4nbwilWHsYXExjBiz

Score

10^/10

metastealer discovery execution spyware stealer

Malware Config

Extracted

Family

metastealer

C2

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Targets

- Target
  
  Untitled_June_06_25_2024_export.pdf.pif
- Size
  
  801KB
- MD5
  
  41dcc29d7eaba7b84fd54323394712af
- SHA1
  
  ddc0100723cc2dc9ae8b02a0cb7fe4a86c02d54b
- SHA256
  
  a909bef708a47ae428fedbc566132c56f15ae7511dc460cf22055ec1a72d485a
- SHA512
  
  5a3e8c1eda558e0b90470d752490bc4d04610f93e453cbfd9013a363cfdf5e607974d526c49efe2ef0440e241d775b66bd7c48c74ee9e8677a37cdedc30c42ee
- SSDEEP
  
  6144:xmbuKA33X1rgMuu+xdaXkW+zF6m8XZPELSrPzA:x6XA33X1rTuuyrVZ6m8XGH
Score

10^/10

metastealer discovery execution spyware stealer
- Meta Stealer
  Meta Stealer steals passwords stored in browsers, written in C++.
  stealer metastealer
- MetaStealer payload
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metastealerdiscoveryexecutionspywarestealer

behavioral2

metastealerdiscoveryexecutionspywarestealer