stealc | b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66 | Triage

Sharing

General

Target

b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66
Size

678KB
Sample

240725-2qqezssgrg
MD5

d4c082c4660a6c5d6c30fd469aedd932
SHA1

ebe0234906ae6c5771a638275c47874427db0765
SHA256

b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66
SHA512

a9f59f8627f1c257c6247d3986e94d4791be91ccc7c791143056c095bf7c07f79bb7fd48d5cc700530b3228ef8b2e5f61e491977e1ea356b7a953467046b4f59
SSDEEP

12288:7WPsBl8o7YNQHN2K3yd9ids0JKpKyVjqdE4VT1VjRydmKceGOlX25HqvoRv:7WEbFwQHN2K3yWds0JkKyVjqC4VTzymt

Score

10^/10

stealc default discovery stealer

Malware Config

Extracted

Family

stealc

Botnet

default

C2

http://85.28.47.31

Attributes

url_path
/5499d72b3a3e55be.php

Targets

- Target
  
  b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66
- Size
  
  678KB
- MD5
  
  d4c082c4660a6c5d6c30fd469aedd932
- SHA1
  
  ebe0234906ae6c5771a638275c47874427db0765
- SHA256
  
  b3613d68d751db139c727ee5b6ac08eaa8c16e65f101d2fc180bbd51f34f4f66
- SHA512
  
  a9f59f8627f1c257c6247d3986e94d4791be91ccc7c791143056c095bf7c07f79bb7fd48d5cc700530b3228ef8b2e5f61e491977e1ea356b7a953467046b4f59
- SSDEEP
  
  12288:7WPsBl8o7YNQHN2K3yd9ids0JKpKyVjqdE4VT1VjRydmKceGOlX25HqvoRv:7WEbFwQHN2K3yWds0JkKyVjqC4VTzymt
Score

10^/10

stealc default stealer discovery
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

stealcdefaultstealer

behavioral2

stealcdefaultdiscoverystealer