General

  • Target

    016f87ea7f834aa2876d1c5179f3f212a0ed1573c2694ece91d6a652ff8a75a0.zip

  • Size

    51.1MB

  • Sample

    240713-kgjgmsterr

  • MD5

    6f151e0e59bca6e3e6971246e8b82b31

  • SHA1

    5b22eb9ce71cf01a3cb970a0f94657f968a7e1da

  • SHA256

    016f87ea7f834aa2876d1c5179f3f212a0ed1573c2694ece91d6a652ff8a75a0

  • SHA512

    d8283c8574da57f05a47ead7523cbe920c6656c19628427fb6ef1b5df9dcda38b21debb1589dffd952830b4cee5b64d44cf97c12037154a0c6c6289293b3bc80

  • SSDEEP

    1572864:3HPI1+aQ85jZtDqlleBskxw6PBVO0gMtIGhgXM0Q+1:Xk+aQ8PtOleO8wGUDIgXM0Q+1

Score
10/10

Malware Config

Extracted

Family

strela

C2

45.9.74.32

Attributes
  • url_path

    /out.php

  • user_agent

    Mozilla/4.0 (compatible)

Targets

    • Target

      1500.dll

    • Size

      126KB

    • MD5

      98809c4402c0cfdf54a144b35799c8a3

    • SHA1

      dff3c8414224c7d4941c2d552378d0313d708d3a

    • SHA256

      e777137eeecba87788899ec5746f46ecf3c3210f700586d7f36fa0cf6e39f385

    • SHA512

      783b81bbbde3c1b9603a233e018d3f932f0c4a9e3849e223577842789f63bc13bad89226fd7c2990cb2396f631bba78b6d0f8dcbf911dcab2a436015bbc0d306

    • SSDEEP

      1536:d2TqgUjdhXFygjM5j8t4dYMlEhb4fpQv9NYZSVdm0tLthoxm5FajpW2EQWEX9DwB:IVyKg45Dd9lcbkQgZSVUK5zF2X9DG

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1501.dll

    • Size

      124KB

    • MD5

      1c5cb070b69fe5ce64502d172beddf0f

    • SHA1

      a008d550fe03896871d612a0d544170aaa365db0

    • SHA256

      5fba54c252074a7687a9a0fdff2d72acc60d3375562b1ef29e5fa561f8063a35

    • SHA512

      c6137b06a92b4561c758fc09fb73687642294a505748932adb77e98f884fe1215508ca67b0dcb09e7047bc7c2043fe30fcb4fbfb002e1800131f8cf987b19bb7

    • SSDEEP

      1536:ClD20jpcFPAPbcISEKlJWmAndT54c0+aC4RMIUN4E6z7xBC8WzINoDyHnOLYmO5C:ClD2b4joNWjn/TSr8D6z7xBCmNfF5

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1502.dll

    • Size

      124KB

    • MD5

      e9238a4aa9136c4800c1575f7d620fbc

    • SHA1

      7948a42aedf1f5136468d8c4466e21ac0d98ab70

    • SHA256

      cd5429c13ed1d6988d9de5393b272e7f84567ce1322fa5acbd7d3ca7739ad840

    • SHA512

      1f0cff6185723209c2098337199ef6a3d4535cf76e8d1d7f4622d5c66e0fda7c8098f48493d147ce662ce304d9c7d1fe678fb7c3344cc6fbbdc34e1d71ac77b4

    • SSDEEP

      3072:/7hs3QpzcrxIGHGNjo3Q3tJkUw5fhhM7eRLg:dwxIGmNjEhUKfM7eRL

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1503.dll

    • Size

      124KB

    • MD5

      e6a0c8caaac1d6c85c26224aa4c84e93

    • SHA1

      2206842b4955c813731c45ceac137eda0cc9c2bb

    • SHA256

      6789ef59e3c1e84fa42221f593d5fee4735b9ceb0a65b9a63f2bddb1a6f3f152

    • SHA512

      1f7ecb5c9141ec7155dff50ecaa4ffe8e773d3b9f9fb9104878c5738c4a16e5d9858c20b449775153aae77436b14949aadbf02966b47e5dfb0733421b6e58490

    • SSDEEP

      3072:pY6Q36NdnMCvqiVm+dJQqQJ5hx1QqHw/w/7i8Tc:fdMCvBVhQJ5hx1QqHwI/7P

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1504.dll

    • Size

      125KB

    • MD5

      c9694b8eff1ba7492952099cfd8e2c95

    • SHA1

      f1f9395fc88cf0b9bc4b756a65590f8ae916fc6b

    • SHA256

      0842f7f4994c49fc41581b2272577903ccf3855db77bc6e2a60c0db859290249

    • SHA512

      326868fa9c782301db89e2fce765874cee61c03b68b137449acb7d80d2fb2f4bbfe6674ada9c2a7589e605658a72ac4a1f436db551befa04edc789aeed1dc818

    • SSDEEP

      3072:HgyX3iIVNOtr4gOYGbKrZ3SIT2bQx9S7ai:33dmrWYGS9SIsAU

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1505.dll

    • Size

      124KB

    • MD5

      9557298f6877e7db648b53d65f49a730

    • SHA1

      0b60b6e74a7be3d2ecb43194f44f4bba958e0651

    • SHA256

      08e37d2bc203ff3669688b0198fb494565ad75b79a324757ae551ef311203bea

    • SHA512

      fc42b3dfbecc19c9beb0714c316f18bfe6f8f4e24d1f1c465657538d3a399d6ec418bdaf98939aedaaa32e9cffc77845aa3dfb9bc332b57b3ae752bb64eb1f9b

    • SSDEEP

      3072:zTde7GNi/RlFXanbgKTNGiT+4sYf0eoySUpj+/TUlRFWviPPkncj:z5e7oiZlFXDaN3T+4sre3SmqsTWaPMnk

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1506.dll

    • Size

      124KB

    • MD5

      c2b56d905914704b1fc9b1d38f7e8774

    • SHA1

      e9c1ab0095e6400b8ecf2d8ce6f2ef100a1c9b35

    • SHA256

      4a81a2236dc4340c02b9bd480e7aebf1d3282afda056202f1d78082db6e25425

    • SHA512

      e476fb87b84a4de5ef72b5fd7c8a14a10ce8870519de9523dc134323f58c1d1c5392f891f58bf0d03ee654541e7c4876fce3a470af77a8e44f5fcea2bba464a3

    • SSDEEP

      3072:cdcNEQxOCeySduhyg3bxF03Rzzta3oRiI2m:cmN7DLSAhyg3bAzIoUI2

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1507.dll

    • Size

      124KB

    • MD5

      ab3b78bd0208c6f9163061a8b70f0f2b

    • SHA1

      be6817bd48a1f9993f923ea3fef5ae5df99bfe41

    • SHA256

      64537fd77032e01238c038a709b65d93946051f03b63e6b39102c6a1afa443c1

    • SHA512

      a97e899c670f840b8964301d1d7805190097a9f7c98c12ebdeb2258da3cf8f2b0ee13980f934efdd950f3cc15b6a5f97f06efb8b74770cd4fb03b862f1b8c0ae

    • SSDEEP

      3072:7lqbzqmw0Qq2GSGvbrN0s/ZvdiO3Liwh:7oA09fbZd/ZvI2mwh

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1508.dll

    • Size

      124KB

    • MD5

      49fffd97692f559039cf390b3769636d

    • SHA1

      e60fef1b0d3335626d294e50b183a5740bdfaebb

    • SHA256

      e86f84e974be2bc8c85823a13e78270dbf653e4ce5624f01c34136ce5e07ca84

    • SHA512

      0c34680073133454d3fff154482ce9861217c6dfca4eed42e4e7fea49ad03db29de9938ac9ab145200ffb6a0c3dd6ad7a9b0f3802e5afca3c227e6ed2ef47da6

    • SSDEEP

      3072:XB4B3ylBZq7q2RIUA+XFjElixNJAHsye8927IqlkD5mE:XB4pEZq71wQFYcNJAHvovlVE

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1509.dll

    • Size

      125KB

    • MD5

      7cdfb9dda218427946183a4de4344898

    • SHA1

      5d966502b0327b69912649c6a8c20b56af96dfaa

    • SHA256

      946e821dd86f5c0472c7a7c8ddd52a3a98822ff0aedd359d3a46d729d38d7997

    • SHA512

      359422563808b4b80d06d6dae9098fe0fd25b5e587c1b3cf4767258d582791a1362a80841f1529804de60abd7a862ab543093ae1e5125a83af617e825ae505ee

    • SSDEEP

      3072:Q2hjWeg9L5EIQOeHZCAt5t6wP8B75J1KF:Q8j89NDQOoAIt6wPo7z1K

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1510.dll

    • Size

      126KB

    • MD5

      21c66f91d15e949e9e743bffd9a9595a

    • SHA1

      0c8f617264793efbcb9e3d19023490cb0a421817

    • SHA256

      88d2e59daa8289c587e8497d452f36f8126962e2ed9b028c02b8dd014688a6d1

    • SHA512

      3843dec70bdbc6d280e9410b1b2ad7b67d963cc3643117dd02ca73ce6f405264650d3afbf7b6116bb07a6a562aa80253ab477a8e17f5b465eb9d3e15b9315bc1

    • SSDEEP

      3072:eaoZ+bClrDqZSbZ8sy83HcqP/Ai4xzg0OExiy+g3FHzB:kKCNqEbqiXNAi0zziyv

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1511.dll

    • Size

      125KB

    • MD5

      ff2b87169ea00a5f5aecd30148419f79

    • SHA1

      8847397a9460d91bb384dd28daed199c7a40ad68

    • SHA256

      40e1266f19d93e1480537e81dd26f7d79ea4bbb14d1ae8fe345fc15f6988497d

    • SHA512

      49c1f28ce8a544d29269df6557b3adab3d713716222e1f4a937bc5356b2d7969d897c93650dbadbf3a9ab8eb6fcf9a585e56117440e87a96511e97102f0386ef

    • SSDEEP

      3072:4vVtHihWev/ZHMR6Th/khx4Ihnr6NVCGsDFdfS/Isz4bt:cVsrsmSTDND

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1512.dll

    • Size

      124KB

    • MD5

      7921fe961b3b8fb7d1a1f8c8b6bbc149

    • SHA1

      7bc93faf824edde654eca15888399f1866b4e773

    • SHA256

      3bd8c1a023ba1f5d798f1d29a706e5f3c4733ea18c35bd4c383946ca726772b3

    • SHA512

      8349cb98690926bb45028ba7010e1bc7a831782851ecf122a4a1336a6c19c52a0320963b22eba4c49df4b4e593821a6d478e53b29360e7eee5be16feee41592c

    • SSDEEP

      3072:ABnr11ScKsxFUkIFcZr5IgqDW1JnHIWKGcfHRi:cecLFUkIFcZCnW1BUPR

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1513.dll

    • Size

      124KB

    • MD5

      bb7ca4c37ec7f5290608b445ff9dd4ce

    • SHA1

      434bdfc3a8536472b59dcad1e05078731afe026e

    • SHA256

      58387a479517d76cbf1980c44103f7d897454b4a5c3050532ee75f06e309c072

    • SHA512

      cdb1bfd05857706fed16a8cb58366662b216978054af730dd8e1821b2874f6488abc6cfa3d9d1fb6f0ae79aebb2859009d09b66cc4a64acb1ac25f8f1b1cfc84

    • SSDEEP

      1536:zOJbWxzPmuRIJW338ZqaL1j893wxVjxwD8r4siUYqUXzAuqe2J4O4oDDgj2lokff:SExDm9bmmaeYqUX8He7sDUCbfyiWyiG

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1514.dll

    • Size

      123KB

    • MD5

      09bc9788d1d85a131b9e76e2f7ecf9da

    • SHA1

      18e2670b8b9d0ef333154c9d60c32d87f6660bb4

    • SHA256

      4c259f5615da5da26edebd3feac569bcb44eb1a239aeed7006a507a81a6e8f50

    • SHA512

      be61c333c29c38d86717f5d3067083c9bfa475d3f7596e6fa9664312488f8a34139cecacc39ed4de75616e4e660c8b474eb5dabb19f173c35a20a91c4745ccab

    • SSDEEP

      3072:ydBTv/ftSW7PhfWaeWSmpXYOg2NbB1Q2/qHlBzMNSfb3:ITv1x0WSmpNf1QzHlZp3

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1515.dll

    • Size

      126KB

    • MD5

      3513c0e1b53bac294e9901bc7b8ee377

    • SHA1

      11e22b8a03fcc644c3af984d4d6d5b15aa774c3a

    • SHA256

      da6a4bd8d484ce72dbc03147b2bde5036c30c6c82496234e60d6e4af36020a76

    • SHA512

      792030d2364475727d2598c3ca5b2bf8f95e1d1308e40be8179a890e02390228603c838923a293ad5a2805677485e689d93b1de91cf810ac7532f8502488e8b9

    • SSDEEP

      3072:jENQAC7Y/onb8s9N/Lj++fuUDosXV6Zmk:jlYAogS+2UDosXkZ

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

MITRE ATT&CK Matrix

Tasks

static1

Score
3/10

behavioral1

strelastealer
Score
10/10

behavioral2

strelastealer
Score
10/10

behavioral3

strelastealer
Score
10/10

behavioral4

strelastealer
Score
10/10

behavioral5

strelastealer
Score
10/10

behavioral6

strelastealer
Score
10/10

behavioral7

strelastealer
Score
10/10

behavioral8

strelastealer
Score
10/10

behavioral9

strelastealer
Score
10/10

behavioral10

strelastealer
Score
10/10

behavioral11

strelastealer
Score
10/10

behavioral12

strelastealer
Score
10/10

behavioral13

strelastealer
Score
10/10

behavioral14

strelastealer
Score
10/10

behavioral15

strelastealer
Score
10/10

behavioral16

strelastealer
Score
10/10

behavioral17

strelastealer
Score
10/10

behavioral18

strelastealer
Score
10/10

behavioral19

strelastealer
Score
10/10

behavioral20

strelastealer
Score
10/10

behavioral21

strelastealer
Score
10/10

behavioral22

strelastealer
Score
10/10

behavioral23

strelastealer
Score
10/10

behavioral24

strelastealer
Score
10/10

behavioral25

strelastealer
Score
10/10

behavioral26

strelastealer
Score
10/10

behavioral27

strelastealer
Score
10/10

behavioral28

strelastealer
Score
10/10

behavioral29

strelastealer
Score
10/10

behavioral30

strelastealer
Score
10/10

behavioral31

strelastealer
Score
10/10

behavioral32

strelastealer
Score
10/10