General

  • Target

    22f48c2310e04b38d52e226f0e3f3190N.exe

  • Size

    196KB

  • Sample

    240820-z7wbfstfkb

  • MD5

    22f48c2310e04b38d52e226f0e3f3190

  • SHA1

    09c934bf443eed4f638e94182962f84b8d4c389d

  • SHA256

    5e65eb35bc8c4d8cb4a8e6a23591964aa75a03eb473c960e7b4264f6084cdfaf

  • SHA512

    904cd38f058d4feca2782ca042a8b5237a7602b2ad27b89c3b09d0750013dae6b3ac5604a9d5b903095ca7caacf4101f235a0f51823f4bfd804e7a3531f31edf

  • SSDEEP

    3072:WkmAyDVkDw12m6xMm4aJgh/gCZTdCFD71fUJR/QBKrVIrevNRiAAdKpmsVbLC:XmfaD02m6yaJgVR+3SV4evNnADsVn

Malware Config

Extracted

Family

stealc

Botnet

nord

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Targets

    • Target

      22f48c2310e04b38d52e226f0e3f3190N.exe

    • Size

      196KB

    • MD5

      22f48c2310e04b38d52e226f0e3f3190

    • SHA1

      09c934bf443eed4f638e94182962f84b8d4c389d

    • SHA256

      5e65eb35bc8c4d8cb4a8e6a23591964aa75a03eb473c960e7b4264f6084cdfaf

    • SHA512

      904cd38f058d4feca2782ca042a8b5237a7602b2ad27b89c3b09d0750013dae6b3ac5604a9d5b903095ca7caacf4101f235a0f51823f4bfd804e7a3531f31edf

    • SSDEEP

      3072:WkmAyDVkDw12m6xMm4aJgh/gCZTdCFD71fUJR/QBKrVIrevNRiAAdKpmsVbLC:XmfaD02m6yaJgVR+3SV4evNnADsVn

    • Stealc

      Stealc is an infostealer written in C++.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks