General

  • Target

    E036A20D879B669BF96F17A6F17F4C4D.exe

  • Size

    3.5MB

  • Sample

    240713-3v5k5s1fjr

  • MD5

    e036a20d879b669bf96f17a6f17f4c4d

  • SHA1

    95eaeb5d63da9766590e2b3c38fc98b46eb321b0

  • SHA256

    d69a93df6cab86b34c970896181bb1b618317e29ca8b5586364256a1d02b7cca

  • SHA512

    ab8aa5d6768c39b5880a2726e4b75e69f2007726debfaa3e6b3f94fcf72b8ce449c58a043d3020fe4fc4d4fc00782d3003c2f3b10f854fb8cad67c406aa185e7

  • SSDEEP

    49152:Bw38SMypl3oScZUU1a4TutGP25RE7qD6yA8u8UZRUb4kig8tldrv+:qsfe3WUUI3h5RyqDTAH8UMboI

Malware Config

Extracted

Family

stealc

Botnet

meowsterioland1

C2

http://46.8.238.240

Attributes
  • url_path

    /201a735ed890db75.php

Targets

    • Target

      E036A20D879B669BF96F17A6F17F4C4D.exe

    • Size

      3.5MB

    • MD5

      e036a20d879b669bf96f17a6f17f4c4d

    • SHA1

      95eaeb5d63da9766590e2b3c38fc98b46eb321b0

    • SHA256

      d69a93df6cab86b34c970896181bb1b618317e29ca8b5586364256a1d02b7cca

    • SHA512

      ab8aa5d6768c39b5880a2726e4b75e69f2007726debfaa3e6b3f94fcf72b8ce449c58a043d3020fe4fc4d4fc00782d3003c2f3b10f854fb8cad67c406aa185e7

    • SSDEEP

      49152:Bw38SMypl3oScZUU1a4TutGP25RE7qD6yA8u8UZRUb4kig8tldrv+:qsfe3WUUI3h5RyqDTAH8UMboI

    • Detects HijackLoader (aka IDAT Loader)

    • HijackLoader

      HijackLoader is a multistage loader first seen in 2023.

    • Stealc

      Stealc is an infostealer written in C++.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks