General

  • Target

    b16ef1bdc9bcba0db197bba5bca6fa08ece713de76412e6bea6de5a8dab2af6f

  • Size

    206KB

  • Sample

    240909-d24jzszbll

  • MD5

    45fb3cd11b294fe8a05691cdab474786

  • SHA1

    cfec8cb59f94b534280f47fcadd68af89107f124

  • SHA256

    b16ef1bdc9bcba0db197bba5bca6fa08ece713de76412e6bea6de5a8dab2af6f

  • SHA512

    e1e26c7706f8d74ae1a0d6d9b1765ee81440746428ea9c6ca9127326dc8fdb2b2419a79109734848978866f52741902f99031b47cb2c9a09427e5a13f51f1f81

  • SSDEEP

    3072:xpd1ryZS4TFEOXqiJb2RztrqvXACp12ob5cNJtFRJodNpzGj8dmfcUY8ll4BzEBO:jdpyIGLCNt8p12hJtFPod7aQIfFWBYBO

Malware Config

Extracted

Family

stealc

Botnet

default

C2

http://46.8.231.109

Attributes
  • url_path

    /c4754d4f680ead72.php

Targets

    • Target

      b16ef1bdc9bcba0db197bba5bca6fa08ece713de76412e6bea6de5a8dab2af6f

    • Size

      206KB

    • MD5

      45fb3cd11b294fe8a05691cdab474786

    • SHA1

      cfec8cb59f94b534280f47fcadd68af89107f124

    • SHA256

      b16ef1bdc9bcba0db197bba5bca6fa08ece713de76412e6bea6de5a8dab2af6f

    • SHA512

      e1e26c7706f8d74ae1a0d6d9b1765ee81440746428ea9c6ca9127326dc8fdb2b2419a79109734848978866f52741902f99031b47cb2c9a09427e5a13f51f1f81

    • SSDEEP

      3072:xpd1ryZS4TFEOXqiJb2RztrqvXACp12ob5cNJtFRJodNpzGj8dmfcUY8ll4BzEBO:jdpyIGLCNt8p12hJtFPod7aQIfFWBYBO

    • Stealc

      Stealc is an infostealer written in C++.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks