General

  • Target

    5ACm77MN7q63MOxGPe3CiriK.exe

  • Size

    206KB

  • Sample

    240811-z8aq5syflp

  • MD5

    d22f922c9b6e07fc161e1367264e29d8

  • SHA1

    f5fe23f6ccb233ddff4b77dc356b01c1c2fc5983

  • SHA256

    fc330820899d3b38c7267818e1603b11c5e66b93a7ff5ec649f2ce033c1e3b66

  • SHA512

    cd7dd3389cd257a28eaa41232b8641900f77bed5713f3670668c73e4e3c65d899cd54a659fc2391b970718ad4d74f6f015d54ae8c6d75a36d928f750bbff8854

  • SSDEEP

    3072:cPa5ECm4gXI65Dk25H3VZISd3j9d0h74X3f7AOi9A82aHFIxiIOuCheHkLXOTKYp:yhlI5293VZIw3JM7U3f1raHFIpURLGEO

Malware Config

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Targets

    • Target

      5ACm77MN7q63MOxGPe3CiriK.exe

    • Size

      206KB

    • MD5

      d22f922c9b6e07fc161e1367264e29d8

    • SHA1

      f5fe23f6ccb233ddff4b77dc356b01c1c2fc5983

    • SHA256

      fc330820899d3b38c7267818e1603b11c5e66b93a7ff5ec649f2ce033c1e3b66

    • SHA512

      cd7dd3389cd257a28eaa41232b8641900f77bed5713f3670668c73e4e3c65d899cd54a659fc2391b970718ad4d74f6f015d54ae8c6d75a36d928f750bbff8854

    • SSDEEP

      3072:cPa5ECm4gXI65Dk25H3VZISd3j9d0h74X3f7AOi9A82aHFIxiIOuCheHkLXOTKYp:yhlI5293VZIw3JM7U3f1raHFIpURLGEO

    • Stealc

      Stealc is an infostealer written in C++.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks