General
-
Target
http://yoroms.com/?join=8285836814
-
Sample
240928-v9jcfsxhlr
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://yoroms.com/?join=8285836814
Resource
win10v2004-20240802-en
20 signatures
600 seconds
Malware Config
Extracted
Family
stealc
Botnet
def1
C2
http://194.31.109.230
Attributes
-
url_path
/dda79c049a4bba70.php
Targets
-
-
Target
http://yoroms.com/?join=8285836814
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-