General
-
Target
0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe
-
Size
389KB
-
Sample
240716-rv9djszepb
-
MD5
35a50d146a389289bf8cf8ae60c9e785
-
SHA1
eb94502d25789eb86dc160c2bc9be4b4a64131bd
-
SHA256
0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791
-
SHA512
9bfe09f5165fd43579d87f229ba4a17cc8af8d7fc50ed629de3ec93e1b8d94d9c6aac17f7a429b401f332623cef2178f0d0f1930b674cf1061d24225e5427ada
-
SSDEEP
6144:blwLkykiFkeLnCUcx/IcoN6OpMW6rTBwEBKI7MUYbuYg785zg2di8DEO:bRiFHnC5m2TB+I70678dXi8DEO
Static task
static1
Behavioral task
behavioral1
Sample
0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe
Resource
win7-20240705-en
Malware Config
Extracted
stealc
default
http://85.28.47.101
-
url_path
/f3ee98d7eec07fb9.php
Targets
-
-
Target
0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe
-
Size
389KB
-
MD5
35a50d146a389289bf8cf8ae60c9e785
-
SHA1
eb94502d25789eb86dc160c2bc9be4b4a64131bd
-
SHA256
0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791
-
SHA512
9bfe09f5165fd43579d87f229ba4a17cc8af8d7fc50ed629de3ec93e1b8d94d9c6aac17f7a429b401f332623cef2178f0d0f1930b674cf1061d24225e5427ada
-
SSDEEP
6144:blwLkykiFkeLnCUcx/IcoN6OpMW6rTBwEBKI7MUYbuYg785zg2di8DEO:bRiFHnC5m2TB+I70678dXi8DEO
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-