General

  • Target

    9b87b62391f32ae8191d3cc4ae27a66acad2394f5dc37ce4ccd8acfcd06e6e0a.zip

  • Size

    51.1MB

  • Sample

    240713-nf17va1bje

  • MD5

    2c34ab60ae04e40c740d89fa24a764d1

  • SHA1

    bf9c7398469a443dae821c069906bec94c879dfd

  • SHA256

    9b87b62391f32ae8191d3cc4ae27a66acad2394f5dc37ce4ccd8acfcd06e6e0a

  • SHA512

    53f702a339a0b9268cabcd5ffefb20bce9d87f1439ffab8c89958272d579e1b9c6e752e87dbaa32465a83b271be67cab235af39e7e80ac0b4a986a6990e48575

  • SSDEEP

    1572864:FGRbwu02JwoDScnCHJaDyQkXrAb+Nyp3DsLMTpFZ:FkbwmSNWyQeUb+Nypz2MTpFZ

Score
10/10

Malware Config

Extracted

Family

strela

C2

45.9.74.32

Attributes
  • url_path

    /out.php

  • user_agent

    Mozilla/4.0 (compatible)

Targets

    • Target

      2500.dll

    • Size

      123KB

    • MD5

      5a2fbdfb269abc89fb0347215a677b42

    • SHA1

      b2719b681343d175773f5afd9ac55514789d0263

    • SHA256

      24be5c04d577b5c1b0480244bc04bcebaa00ecde428dcdf9f81592b81eabc7d0

    • SHA512

      36bb745cd67c68daccba0d514f5bd6a012d2adff4af678c72e61a08127a58d1f699099dda28b5e79baa1c7ef4468f91583122478c7c01399e08c5305a40ee9c3

    • SSDEEP

      3072:mBc9vsF6PhBJ5EdL+hL2kl/Xx/uAqA1fYhV4LoOrk8:r9v+6PV5Ed+hSk1h/uEGqLoOrk8

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2501.dll

    • Size

      123KB

    • MD5

      71941765cf3f91539670e9da97524f12

    • SHA1

      42522b79530a6547395e2da6a51ab1ba75efa1f5

    • SHA256

      6c9f62bbc59e780427130849714c0b51a6f7dc0721262cd42bfe7367ee2df909

    • SHA512

      4e645610f220092b4dd999fe9cd0270a10b03ea7e12dfa89c8ac801e182a70eff461eb58def3c821b3f2a45b50e2f6f377841dfae0ce8bbb400229ce5f55f1e3

    • SSDEEP

      3072:cT6rqTWMAk7QBZfPmmGB5X5Xxo2e/oQp:C6rqSPFPmmGBbvel

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2502.dll

    • Size

      127KB

    • MD5

      945b1669e4f45256d95035dd134b6d66

    • SHA1

      d98682357f94b2588947138e84675f1a4f379910

    • SHA256

      071152aaa7463563cd096a80edc08910af72e39f60a30f9f58dd575b3e45d574

    • SHA512

      33d74255ca8b34247710a1d0c9fa3cc0375afd004fec81a11ca07c0c300809041b0d4a043f0f007fd1b73b772b715b9d696bc96d633d399831b6a5972956218d

    • SSDEEP

      3072:WFQgZqLERfA7LPzv6vhPhsTIE1RXFgG6s3QY/iYwbYAzi0:kcLSi7zvsPGPRF6SQY/iY4m

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2503.dll

    • Size

      124KB

    • MD5

      6866f469072519cab1ac1f6841223943

    • SHA1

      b87e60a3b036f30b9f29597432d91f12c1c26192

    • SHA256

      087f9ac09388a7dcaf2856b11fc2c4123e7eadeae293b4a1c682cdb36e5ec1e1

    • SHA512

      47331b95d412f3108781641f2c6c3e6896be11f5a86a215d262d9c46cafdeeb7518ee17638ddde362e5a199efda0af51b68d5d4634265ccd82f0e987670c29d7

    • SSDEEP

      3072:nt9+gJp99T8eA1QtW01sktX81fxDe18yE3fg/:ntEmXtIQI7kixDg0g/

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2504.dll

    • Size

      123KB

    • MD5

      509d384485639c504e30edcc70896de4

    • SHA1

      a8eed638edec2d2b0d16aa6831b9eddfb57eb381

    • SHA256

      04374ad9b910b34783e162a599efa2a5e5b113a5ec122d1463f931bfe5aee432

    • SHA512

      4b1bc5e7e5f8bba298a180fb4bf57ac4b06f6adf1e1ec625f51e44519597d1dfd014503f64073009285b5df0f1182672c7b0354ce8a19cbc0fcd05d2ba98529a

    • SSDEEP

      3072:fA3kA5B2GCgq7w5gn1QLvRJpOKqrPQ8Kj0LAO/:fAn2QI1QLvRJ7Lj0T

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2505.dll

    • Size

      123KB

    • MD5

      45bee3d6f697972df61a928c78bad816

    • SHA1

      556dfaa76e524f9742fa10da08e42b60a4755dd5

    • SHA256

      9ba59f72355fa5db984a0922aad3482af01a75c1f493558b090944aae5d458d5

    • SHA512

      0a23b623790450c120dd768f2e9dfa08e2bc8bb7d2eb91936fbd2a7d00606786806d296f38a7b98adff15c7bc216fca1280d5f5231d47604a39c4a2a2dc11113

    • SSDEEP

      3072:OPLJkxTM4t0zEYijK1ez7MEF8gMR0hv+zoSq9QKgTZ9PzWfzujZNjXVPSvjzwZLx:OaTXMEGqMExMRdtTfrNjsIyqMZ

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2506.dll

    • Size

      123KB

    • MD5

      1e12d0094de5fde87b49c3ef4426ea17

    • SHA1

      15b01f6d79276677027f587fdc5437121bb4faa0

    • SHA256

      d7db3d8a5c676e98bc41242c884dd4ca4bdf586d52e2e74a0801a242eb14279d

    • SHA512

      75fad41b74be3a7c5917aabdac6147e9d8e4261adce666902c9d57d8b2fa3576bf8a874f084a78a69d302719926b1d2fb134ce574cc6aaaf4f4861cd71345fe9

    • SSDEEP

      3072:4bbDvni7zks6eYPEhg6TD70h9Z+na09Z9PGe7xvCAOlgLLZf:4bbe7P6es6TDQ09fjxUlgR

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2507.dll

    • Size

      123KB

    • MD5

      29771667f3ede38ab2102f81ec90c1cd

    • SHA1

      116bacba3f599a8ee76ddd9c1fae9075cdacbeca

    • SHA256

      118681805a6a16e921b03c5d2995b6302b8b78cbe7999eddb05585f57f978528

    • SHA512

      4c463faf644c610019db603e37a67e17151ee896ed02cb8177669a62dc127e1994b21f21ec3d535241d9e8412916d52e792b3b2d4515a7508426eb717829a753

    • SSDEEP

      1536:Pa3mPZ0jsc47X0HtGDx7Glv0wiTnXhbPrNV7Az4P1/p3tRB9fE6cFcSTlyzMPgn9:PFPCjRHADpY+XOzCPhE6cF7poz+0eS

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2508.dll

    • Size

      124KB

    • MD5

      79f35e8b775679fdab7a8522964a09f7

    • SHA1

      f4c9d06ba4929e4cd27ad1ffc7f4173cac83c480

    • SHA256

      9a76854650fa92aa00e52fe1b2b0a2175b34725fe707e23e78e41e86e35c2774

    • SHA512

      e72234ee11051c64d0f293cc054646505b2277532ef19340ef354ffda985f660061b7eba440230f367356abfac5008375c96ee9aa5cfbebf0985705dcae06635

    • SSDEEP

      3072:ZIwCBqEkwOst+n264UXjpybUv1QTbnrZ1PU10kXwVhH4G7+R:ZvCBxSs164Qy4v1cnjETgf4G7+R

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2509.dll

    • Size

      122KB

    • MD5

      efd359e9ee52dabdfcdb048f70794e64

    • SHA1

      5aed7258a5d0f101d5f2a000104edd154f15eeb9

    • SHA256

      7b4543b495152361104e67db8bd8aa3f74f8c2f2e6caf69ce4367748db51f584

    • SHA512

      de4e3caa83e380878600cf00103ab53a6f89f2be9f777c2ed733e4d201fad095837c9cf352091dd655d0b6df2a0670510bf71e745595cd2a071071e6c4c78c5a

    • SSDEEP

      3072:++W4zpqlqAiZC2FcVuPvd8i96bnoYCluH7X4uMSQ5L7gqMwyFuD:ZW4zpqBiZZ6Vkmc6bnoY8uHDOSg7Phys

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2510.dll

    • Size

      125KB

    • MD5

      b2f2a7041f4a55deca5888ca4d2a7899

    • SHA1

      3bc51f1ffc90387c30e30cc948a8a343a7136371

    • SHA256

      fbbf3b2075f1007a7c9ecd9637d847547451dc7344f1ef7c36cfbba38f72e847

    • SHA512

      63470d2f766494448f1737db6e0250a9720182a87cd8e7bbf53aee2899a5393fc381367d71b2634424a7042784a6cb278e196ff22f40d90de8366e3f0b42f79c

    • SSDEEP

      3072:bvZkT5IbjNnmjG+RrWn/cbGBtWNrPGz8WqZ+K71vbw8:LZkViNYG+RgtmPLL

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2511.dll

    • Size

      128KB

    • MD5

      6eae5da4986feb5b0a2072da19199180

    • SHA1

      be1d657bb8d1445b8e7ad3d2af5831322c6e091d

    • SHA256

      55631a3bf8ab4443946e456931a045cd2677cae52c60ced11bd047f70cd60584

    • SHA512

      22b3aa6338bf823bb39549f2b02eb1c7fe637cc6b7cc1844c7f2dab454ef657632a516e6df7be213a1037aa0d6a6e0b0f55668d889b16fcf6687397866322fdf

    • SSDEEP

      3072:8TJ1MtmOB7/RaTrLGSapv9ahgY0hbrSD:8t1Mt7Za+jpv2Ahb

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2512.dll

    • Size

      124KB

    • MD5

      c58d242b7133f4e48b6bd2ede69da684

    • SHA1

      688b53e6eb96957a78d13623b9caea087ea7a609

    • SHA256

      1a72982a91c4fc71574c8067a2f065eb9e9e984d79e6dc9441a92c6ab5418c74

    • SHA512

      0fba3986c4d43fd0c94d25d36c84dd01bfa1c31087c03de114be566bf857638f6a687a1af487681e8878090dcc0f4942f047a73c7cdbea4612308bca5297c84e

    • SSDEEP

      3072:Y3cBvYYm9ACipoaeLdy26pm8F+wv0hazkeDAimwHhKD:gx9Alpoa0IXMapEim2K

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2513.dll

    • Size

      122KB

    • MD5

      fe065e58686d9ed14ce6cf399a5a4f58

    • SHA1

      ee3c0f4e4b5cc85515b6c9f5c3cc222fe86f9411

    • SHA256

      f3e2c12cab9e53ec7686c6035b83a991f8628608d2463c383bdf6f8198559d29

    • SHA512

      2419ccf0a3af661b8218ad623e29cafae934b845f17f7b8e245b01e01d397ac196b0adb5ab4f8e6cc5fa5f0a06fa64cb670bbf2566c0e8c6a19fddc60106f340

    • SSDEEP

      3072:vIclJhSs+KPHEGTozV9x5lc5JYOgHMNeCkyCT:vISLZPkGTCcMOgsN

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2514.dll

    • Size

      123KB

    • MD5

      decab95d811ee89f50142b8a1addc708

    • SHA1

      d65a2daa25d0740a929e82a58231baa8e70cd4ec

    • SHA256

      9fdb40b4f6afd1c074110f15286cb86568284465d4ff2a24c5dc2fc339801e3f

    • SHA512

      0ac98dde63172d5e560a5e5905e2b02d023cedce0fc074ca8bdf887cf47e2056c99afe3309c2b26e3057baf5081f3fc3b05aa0c568d6c19cb57a61af9577606f

    • SSDEEP

      3072:lr1xYteF9LB19VrrSM9l3qlvlA2yY/AYorOgCzm3CX6:lr139H/Jl6ltp1Anyms6

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2515.dll

    • Size

      124KB

    • MD5

      d3a5695976435b0d8028f0ef48018aec

    • SHA1

      211af82c9ab277a726c251de5b767fcce1e358b0

    • SHA256

      53f659b44d032e18cdabf81acc327517cc68192576458a54de8ca5979f5fe676

    • SHA512

      cbfc2b11dcbd87902fa9d7e1c1a7247cb4c4a8a2819895682eb530e0901eace4320a4d707992dac6e2e094199a7d69d0d1e3f5bd0a24474733630324d4848c98

    • SSDEEP

      3072:Y320SO3w40zX58A/w1n8HquBtxSgnfl8jbBhiKhGE5DbIuJ76/:Y23O3w4Up8It1ZuJhqSfIX/

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

MITRE ATT&CK Matrix

Tasks

static1

Score
3/10

behavioral1

strelastealer
Score
10/10

behavioral2

strelastealer
Score
10/10

behavioral3

strelastealer
Score
10/10

behavioral4

strelastealer
Score
10/10

behavioral5

strelastealer
Score
10/10

behavioral6

strelastealer
Score
10/10

behavioral7

strelastealer
Score
10/10

behavioral8

strelastealer
Score
10/10

behavioral9

strelastealer
Score
10/10

behavioral10

strelastealer
Score
10/10

behavioral11

strelastealer
Score
10/10

behavioral12

strelastealer
Score
10/10

behavioral13

strelastealer
Score
10/10

behavioral14

strelastealer
Score
10/10

behavioral15

strelastealer
Score
10/10

behavioral16

strelastealer
Score
10/10

behavioral17

strelastealer
Score
10/10

behavioral18

strelastealer
Score
10/10

behavioral19

strelastealer
Score
10/10

behavioral20

strelastealer
Score
10/10

behavioral21

strelastealer
Score
10/10

behavioral22

strelastealer
Score
10/10

behavioral23

strelastealer
Score
10/10

behavioral24

Score
1/10

behavioral25

strelastealer
Score
10/10

behavioral26

strelastealer
Score
10/10

behavioral27

strelastealer
Score
10/10

behavioral28

strelastealer
Score
10/10

behavioral29

strelastealer
Score
10/10

behavioral30

Score
1/10

behavioral31

strelastealer
Score
10/10

behavioral32

strelastealer
Score
10/10