General

  • Target

    6be66fbea4373a04b2db664aa5687a188150ad58f39070fca97fdf5674a9854e.zip

  • Size

    51.1MB

  • Sample

    240713-mlzqjaxcrr

  • MD5

    f4dfcc8c00e503d239e0d4fa9b77abd0

  • SHA1

    d357f3b3da341cd9854c103508b6b1076dc2c0c7

  • SHA256

    6be66fbea4373a04b2db664aa5687a188150ad58f39070fca97fdf5674a9854e

  • SHA512

    5f6e05f54393855147c68dade6faed898b978fcea306d3dad226aefc64a1be2eaa1b49aefdf9738e98cd3dd92b51a049986d04324d19b5f30ab9c827df7d66e7

  • SSDEEP

    1572864:vA8gp+OlUtiAnylI6SwZRvU72Ho7l+WHujAxkMmFW5m:vDA+OlUtznRwZZUKFWHukxVSW5m

Score
10/10

Malware Config

Extracted

Family

strela

C2

45.9.74.32

Attributes
  • url_path

    /out.php

  • user_agent

    Mozilla/4.0 (compatible)

Targets

    • Target

      1000.dll

    • Size

      123KB

    • MD5

      cf3bbdd6ed9b53efb784de6cfe6db183

    • SHA1

      d1681e26ef381fcf4338ab341d2b8dd3d1fa6b45

    • SHA256

      a8204e5162ab23ccf1bc47761a9a896f529a6f92e34f791977138d4a1ebfb50e

    • SHA512

      e7ef2ac6c88daae3d6173253507d32157d9206eef85d1a2ace06eb6001bf5f16c9069aa7ecfcb722de21f09a308b5ca6c3129ae0ead4d9e09f698facc3438bd5

    • SSDEEP

      3072:DenJDaBgE1XE/i3GK87XoYKoZgc53z63Yw06RgssRN83Ji:DYJOBg6EnTngfR0OpsRN+

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1001.dll

    • Size

      125KB

    • MD5

      f082ad2e1b279e7c78f6cc19d19df932

    • SHA1

      187592399430865a1d2f5db094416284be6194dc

    • SHA256

      5b9da382ffaed1bb9c79eb7e415a98a17b69537c18b437d63fbde262e80775a7

    • SHA512

      fc55cde24c4ab6499d908224d3cfc0d04d680ed6a30d4b44991cf932ba06d294b9816897f45ab2f939bad1392b3af07c44194eda5263b45ddabb5c3a53fde81c

    • SSDEEP

      3072:+3lSxAMTwx/dSUOSes1bTUk4PHS2VfFlibuaIepO:+CAMTwNdpxeCskdDIe

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1002.dll

    • Size

      123KB

    • MD5

      b70ca31e717474852af87178827b2d41

    • SHA1

      1ec9c9a55467a2984871c25248876dd6a42100b6

    • SHA256

      24f788d9aeb1792997aa1172dc1f85a94476010d556d94f249b8e3b02b4bb72f

    • SHA512

      fd29e4d02f7e8bf1d3204118dd8c65fc942d416815f17da49621ef03da2e4163e3ee8fc62b7db96c30517331f0f05fd93015259b4951624b968f155e640b0b24

    • SSDEEP

      3072:Yo4Lm+yulpTKNUJh4/lysWCY2gEs2dSgodmgTM1qc0:YIFNUlPCY2tdSgodtMo

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1003.dll

    • Size

      125KB

    • MD5

      63c9b3f7da6ded3a47c2b73854551d2a

    • SHA1

      cfca1f39b48bdb012cf7f3fc6b5ce640602fe7f4

    • SHA256

      07818aa88067be18c3e60d24caa3ea3cc6f8da8d7dc157e4bd584b5f96cc43ad

    • SHA512

      769373780d3008235cbebb75aa5662ce2f84f7a093432d276288cebe19707d73b77bdb6e9e21e9eb0a93ac358a0379bdfa40aab13212bd29a86423a214c2b0c1

    • SSDEEP

      3072:zlAQdKOUpAlTiRvoFOiw5uUfHt6Sc5CsAQeFhkgn6s1R:+IKOUp0YuEVsAxFhJJ1

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1004.dll

    • Size

      125KB

    • MD5

      adb6156dcd16017f15925ea493eb92c6

    • SHA1

      9f667bc3a8bb7e054721bd38b1d9d2484cba1922

    • SHA256

      7ac66f06cb949011837dd20dd32adbe82ed7287306c843b212e306ca54142867

    • SHA512

      61ea90cd0888315be28943c4d86be1e58c5258f8827059e911206227fc018fe0dead3c5ca14dd52e97fa04bcc0a9e2c04ad99757f9622cc649c6699b1b802052

    • SSDEEP

      3072:F6O30RPPMTvnvZ0QM4frgUivyDUvThKu1nvXV43:R30lm7brgPaULEuhvl43

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1005.dll

    • Size

      123KB

    • MD5

      d933abd426e85aee86a9553a57a2cb22

    • SHA1

      0647d3205d4fc003597c4d992dd7ff547a8b269b

    • SHA256

      b1714906c9037f443e25c5862a0059abcf623be36ad914d1009a7f93250531fd

    • SHA512

      dbdd6fd8862dcfb84c8f06af50545ba6f0cbe991f51930409d83b14eea9a34348dd196b4f92334e0fbec30af2912afcf89821b045e1042b4805e75e52f382476

    • SSDEEP

      3072:VY5DvIdqwcHx7wE2gcGvKutj2d/q9Gswo:4DvIdXc6E2XGvKutj23Bo

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1006.dll

    • Size

      123KB

    • MD5

      2c8cbf838f6f78ac14fc094e155cd573

    • SHA1

      cfc0bb4f649ee520a081d9668de3ad760f643aaa

    • SHA256

      0f190115590f648deb23dfc81725fb5b70bbfedcd88b387da62bd54a750f0943

    • SHA512

      f7cfd7597db087c07a76721fe86034ffd1f4a5006c3ae5a9c6a71f74de9cf290dea747be00a474dfa3c4d18276e0ac3282622b0094249c0e7ece9115e28e4366

    • SSDEEP

      3072:gx74a7VGN+77QxdB/bm5IKS5K7G8VCZs/xUl2NfZw:K74a7kg7QnsiH8CZ/2BO

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1007.dll

    • Size

      123KB

    • MD5

      b15307d9f01b8f9a23beedbf64bdfd42

    • SHA1

      790d98a009f0b92bd25d46500350260c5a4938a7

    • SHA256

      8379409365ef8b9863349e0691d13a8e2f99647c5d0c2b6c986082cdb775d751

    • SHA512

      0e9d2dde3737ece0e39878245dbb7d9779662869b24b71a3002918736449217f07aa68af8e8e99b87d51b11dbc653be2e6c0d6c12826251df22e8b7a18455cf8

    • SSDEEP

      3072:w/Gb4lyj2yq+xyrMmLij5r94SS7x8+RwTl:KEWyjjxxyrMNF9Y8kwh

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1008.dll

    • Size

      124KB

    • MD5

      4e96cc3f695c7d53bef3d63599ee52cb

    • SHA1

      663f95c33a4a26573b3c8faabde292fbfb36cfa8

    • SHA256

      2d441ededd0e222fa7fe23a5ef802eb60cbe31b4454663fe4fb7dd310ceec654

    • SHA512

      97391caa030dddd00297f0043aef739dc8c326131e86786b25e1e60da75febc181165d88a7b10e1dcc78d210e2b998b633ee0599e588cd39e4835207ce4f1707

    • SSDEEP

      3072:hQp7DMU282B6rALodshbX6ZCIqvuj+AixyEgvX9K:hQV4/B6Hpt+AixyEgf9

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1009.dll

    • Size

      124KB

    • MD5

      daa32a4055a2d8d58f2521b4388153cb

    • SHA1

      5355b0fa3f71bb8ac368dd248cb4b47b8ebb266b

    • SHA256

      e16951ccbb744fc74c3e5b75eb006cf3a3c8a1dd6833bef31a9fe3de16937685

    • SHA512

      ec55b63c24b9d5514632a161c782e17751bb42ccf167d0af8324c6af40966551a0d20ec8f85d8bec81dbbeb4dfbfb92c57ad64df4824ccaa9f0d9db0e1620cd5

    • SSDEEP

      3072:ubLygxNAJYGh50xXIya31CJLCpXM5XTzV1w4ZDpT:2+YGh5wXG1Zk

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1010.dll

    • Size

      125KB

    • MD5

      85dfaf4e829f098d99cb92dd9ceeb1e7

    • SHA1

      bdb5f665824dd688a69c690ebe5876cf4fd5fdfb

    • SHA256

      e0edebe94ba8eb46d66d29dab8d10f3e0584394644de71280e96844813b2619f

    • SHA512

      ebb4e63ed689b15582eefed6d337526036ed607b7fd51093f4be8f5646479454dcb6a879e2202c78d04df461947f8ea25d7fa1058931097cec667912d1ee9a7b

    • SSDEEP

      3072:iwQzK6ZzfjTnXkdbbnQGm4HnGX01gn5AMxPJ6W1P:YK6ZbvXkVbnQgnWlxxL

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1011.dll

    • Size

      123KB

    • MD5

      1f6b001b89cb03bc1f08527bfad860e2

    • SHA1

      0bd22e653a14557e4fd5a838f9a150110c8381c3

    • SHA256

      f667cc5a0d49ebecbf9cb94f9ad9468304db203d2cd8e6423a61c56e4312b489

    • SHA512

      6a800f4b51dd414914402011a78b59ee41b212b9c6268ba042f81518876fc79b67e53048bed87226d35ddc035e6956e1ea205a473e2dfa9a97eb2618a48a70a0

    • SSDEEP

      3072:BgLQ9H/hktbqVcpO/XO1FGyPkEpQpd5JZ3HhiL8:Bg6HqFqV0cXOatkQpdlA

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1012.dll

    • Size

      123KB

    • MD5

      02e3e4659d33904bc1583444bdf0e0d8

    • SHA1

      aa34d467219326e6838273abe6421522897ee958

    • SHA256

      bd5a15e14aaf12cebfc23109f04f81288e7f227ae0507abe5821088bd5ca44b2

    • SHA512

      d0fec9c5dde24f91972e1863d8705893c079448939ab2263e773c5b0d16c7a8019931ba60e3587fbdc4321b88fded1b237b3a93c3b62856e416a73c89643f654

    • SSDEEP

      1536:wWtsHt7crUZmsmZn2aG/vmTC8H3E1uHh9S7EQfWZ1gDH/XtmGQ9uB/LpgCXA4+b/:uHVcrZsouvmeuHjKOMDHftoUl5Z

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1013.dll

    • Size

      123KB

    • MD5

      1f7b840aaf96da1713236469a2186881

    • SHA1

      90ab5ea51bef65f749aad2d5283978f37b51de6e

    • SHA256

      952a934d9cb8e9bed7d6e9d03cbb0d0538ebb796a33661b0b9cde8ee5cb804f0

    • SHA512

      e8eb44297de40a8c2a2004f72f4279854102ba728a0b848ea6b0bd054048271422de89b3efdc7973fb3a58b19002c64fe8e638b6fd48c5058c68fe73cf817738

    • SSDEEP

      3072:MHQvRUR16W3v1eR+m5kdiAaGgN50b90iTiUbTf:M4UR19YROiAqTsBTxbT

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1014(1).dll

    • Size

      122KB

    • MD5

      03ca072e447972ce4741b9d3f4566cab

    • SHA1

      31e5dccd102dcf91567b3061fbd8ff89f20efa1d

    • SHA256

      a3cf3f9408c6168141c27ad45f0566dff0e1ae4c9a7354b5e583b279f31d365d

    • SHA512

      36ea21a7c8ed9e0ea7edb142708b245eeaad1b2308a986ae3680d571a3c84f60b3224e953792606c5579be1770a7b03fb69118017c6b5e3f979ebb43384697d6

    • SSDEEP

      3072:Qr7vUfh2o3K/1WMdkRvIkFkwcApOPvA+FoRglEjZF+re:M7spG1PkRAE38nZlIAe

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      1015.dll

    • Size

      123KB

    • MD5

      ff16c6e786b36997b418dfcd3cc3cb28

    • SHA1

      82ad3568eb07772ef928c088cf95240a716af349

    • SHA256

      2da9a77aec0d154cfa9c933aee9ccf0e9e8349fce95e6f111099b2237e5796c2

    • SHA512

      684da0ce6e8fb7bfb3e01e9e2e72ee5b4c4a19c3732a8b21e71e955a7191034d403871c1aa93d912f04127526ecb20d8bfc1c69b671464f13273b96dfcd3080d

    • SSDEEP

      3072:+8LXsyn751JNUuZ7Dnmn8fIitk4qzb/4J:n977JyuNEYZtkj2

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

MITRE ATT&CK Matrix

Tasks

static1

Score
3/10

behavioral1

strelastealer
Score
10/10

behavioral2

strelastealer
Score
10/10

behavioral3

strelastealer
Score
10/10

behavioral4

strelastealer
Score
10/10

behavioral5

strelastealer
Score
10/10

behavioral6

strelastealer
Score
10/10

behavioral7

strelastealer
Score
10/10

behavioral8

strelastealer
Score
10/10

behavioral9

strelastealer
Score
10/10

behavioral10

strelastealer
Score
10/10

behavioral11

strelastealer
Score
10/10

behavioral12

strelastealer
Score
10/10

behavioral13

strelastealer
Score
10/10

behavioral14

strelastealer
Score
10/10

behavioral15

strelastealer
Score
10/10

behavioral16

strelastealer
Score
10/10

behavioral17

strelastealer
Score
10/10

behavioral18

strelastealer
Score
10/10

behavioral19

strelastealer
Score
10/10

behavioral20

strelastealer
Score
10/10

behavioral21

strelastealer
Score
10/10

behavioral22

strelastealer
Score
10/10

behavioral23

strelastealer
Score
10/10

behavioral24

strelastealer
Score
10/10

behavioral25

strelastealer
Score
10/10

behavioral26

strelastealer
Score
10/10

behavioral27

strelastealer
Score
10/10

behavioral28

strelastealer
Score
10/10

behavioral29

strelastealer
Score
10/10

behavioral30

strelastealer
Score
10/10

behavioral31

strelastealer
Score
10/10

behavioral32

strelastealer
Score
10/10