Overview

overview

9

Static

static

3

cstealer.exe

windows11-21h2-x64

9

Resubmissions

19/09/2024, 12:24

240919-pk5lhaxhqf 9

19/09/2024, 12:18

240919-pgzk3sycqm 9

Sharing

Copy URL Twitter E-mail

General

  • Target

    cstealer.exe

  • Size

    11.6MB

  • Sample

    240919-pgzk3sycqm

  • MD5

    b8a7a6aa3784f12c0e9f3d31e8c43d0f

  • SHA1

    68b7567dbe66e934089ced323ee425cc37612aa1

  • SHA256

    c394cc6cca08928f88ec7f1bbd228dc1b2cfaafcbc3bdde83131c9f32d408187

  • SHA512

    ed3f7f20e210d0ac0d217c2cc4283031250c7ee5a9e20ac47cca59a621cd6236012b321f44dd8c0b2135ee389ecc99c4eb7673a0cbbdf39bd846e49d8283c519

  • SSDEEP

    196608:tUEk1CtNwVEo+2XMCHGLLc54i1wN+xjXx5nDasqWQ2dTNUGdJP6sSEhlAx3J+iIY:WEk1CtmVEb2XMCHWUjJjx5WsqWxTM0Yj

Score
9/10
credential_accessdiscoverypyinstallerspywarestealer

Malware Config

Targets

    • Target

      cstealer.exe

    • Size

      11.6MB

    • MD5

      b8a7a6aa3784f12c0e9f3d31e8c43d0f

    • SHA1

      68b7567dbe66e934089ced323ee425cc37612aa1

    • SHA256

      c394cc6cca08928f88ec7f1bbd228dc1b2cfaafcbc3bdde83131c9f32d408187

    • SHA512

      ed3f7f20e210d0ac0d217c2cc4283031250c7ee5a9e20ac47cca59a621cd6236012b321f44dd8c0b2135ee389ecc99c4eb7673a0cbbdf39bd846e49d8283c519

    • SSDEEP

      196608:tUEk1CtNwVEo+2XMCHGLLc54i1wN+xjXx5nDasqWQ2dTNUGdJP6sSEhlAx3J+iIY:WEk1CtmVEb2XMCHWUjJjx5WsqWxTM0Yj

    Score
    9/10
    credential_accessdiscoveryspywarestealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks