Overview

overview

10

Static

static

10

updateload.exe

windows7-x64

10

updateload.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    updateload.zip

  • Size

    2.0MB

  • Sample

    240707-k3x7xs1bma

  • MD5

    ddfe0e54ec6993edc4354fa83ed25ebe

  • SHA1

    c85d37e1dc98d019726619d95dd58960b0666a2b

  • SHA256

    7452147f1175b71e6b3f8bd0b7b3de69865ef7e8466473434430e2a08dbc3ebe

  • SHA512

    9384122202d7a7c462fae2ab00dcb9b506d4b390bf9416e76161990cbddd6d53021415a9b022427f58367d15908adf7afbb7322128eff08ac36e646a5d52f590

  • SSDEEP

    24576:9nn2J4d9vM2FJsJxXslUPkPsUN4D+j7UaZFh5gg+93w96shriabgLiRfIVoTgQF8:9nLFsxclV1Nh4Mmg9ZhyVWg060lcp

Score
10/10
hijackloaderstealcmeowsterioland1loaderspywarestealer

Malware Config

Extracted

Family

stealc

Botnet

meowsterioland1

C2

http://46.8.238.240

Attributes
  • url_path

    /201a735ed890db75.php

Targets

    • Target

      updateload.bin

    • Size

      3.5MB

    • MD5

      e036a20d879b669bf96f17a6f17f4c4d

    • SHA1

      95eaeb5d63da9766590e2b3c38fc98b46eb321b0

    • SHA256

      d69a93df6cab86b34c970896181bb1b618317e29ca8b5586364256a1d02b7cca

    • SHA512

      ab8aa5d6768c39b5880a2726e4b75e69f2007726debfaa3e6b3f94fcf72b8ce449c58a043d3020fe4fc4d4fc00782d3003c2f3b10f854fb8cad67c406aa185e7

    • SSDEEP

      49152:Bw38SMypl3oScZUU1a4TutGP25RE7qD6yA8u8UZRUb4kig8tldrv+:qsfe3WUUI3h5RyqDTAH8UMboI

    Score
    10/10
    hijackloaderstealcmeowsterioland1loaderspywarestealer

    • Detects HijackLoader (aka IDAT Loader)

    • HijackLoader

      HijackLoader is a multistage loader first seen in 2023.

      loaderhijackloader

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Downloads MZ/PE file

    • Deletes itself

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks