General

  • Target

    4ba424fcbd23c58e1ec6abf8e307eef0.bin

  • Size

    2.7MB

  • Sample

    240913-blcefswfnd

  • MD5

    c552cfe856f450a00eb297742ba14866

  • SHA1

    5ce7eb745e4e248733d9661f54c4ff6285d77e7d

  • SHA256

    b38d59dbecccc9cacec894e95372f8d55c64d8f523b5eb99b5bc196872258e7d

  • SHA512

    b79135f3fe39bdb478e903aecba3d33782752540f1de46f3faae8c393025292f5eef733d2689c284982c3abf8bfedcde1a6d6db6a134e4c457120166712abaef

  • SSDEEP

    49152:qsGSGNtr3u96JVucSDx/JdmXFoFWIayCvyp075zMKaxEc3uSzXxnjeNPV:fGNtL9JFSDxGyapMb7LzXxjeBV

Malware Config

Extracted

Family

stealc

Botnet

traf

C2

http://91.202.233.158

Attributes
  • url_path

    /e96ea2db21fa9a1b.php

Targets

    • Target

      ec2112fa3e7b6680d48cd0129b5364bd1eb76573235dc1eadc2282eaf3bb2709.exe

    • Size

      3.9MB

    • MD5

      4ba424fcbd23c58e1ec6abf8e307eef0

    • SHA1

      e216ed7deffbf2e172be86b2b3eb015ac8fccb23

    • SHA256

      ec2112fa3e7b6680d48cd0129b5364bd1eb76573235dc1eadc2282eaf3bb2709

    • SHA512

      f7cf58c2ea12dcc6ef9fe57af122bddd64685b4840205021ef1f70494785cb58b382e66a6b9bef37f295d332c02260f3297ccf9152586c25b6cdf334f5e53ae7

    • SSDEEP

      98304:qy20g76NTTPs6deIF+iHtcbBt2VSFjUCaC:qy20K6NVdeIMiHmbeVS

    • Stealc

      Stealc is an infostealer written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks