Overview

overview

10

Static

static

1

out.exe

windows7-x64

10

out.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    out.exe
  • Size 4.2MB
  • Sample241001-ga3edsxcqa
  • SHA256 bdfbde6a7c86951c60c4910e681e870bcc17554b6260ed6fd22c8930996c7907
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
metastealerdiscoveryexecutionspywarestealer

Malware Config

Extracted

Family

  • metastealer

C2

  • ikswccmqsqeswegi.xyz

  • aukuqiksseyscgie.xyz

  • ecucwceswgqiscai.xyz

  • ggeguiacmksquiwq.xyz

  • ikecgokgwsysscqe.xyz

  • ausmoiqykiskemym.xyz

  • koaywyekuqqeyyww.xyz

  • auegquiusggyykii.xyz

  • seaamokeuaweaima.xyz

  • wmyekoqqyyqyoqgu.xyz

  • yqaouccmkggsweqk.xyz

  • uiggiccuoaayaqec.xyz

  • qamcsicuaqsaaqyw.xyz

  • wmeqmmsqaiaayumg.xyz

  • ggkswqokuuisecci.xyz

  • owswomyokkgkyayg.xyz

  • uiqyyqqcscaiaska.xyz

  • uiuqygeuogieacgw.xyz

  • yqqeqcygyguuwwkk.xyz

  • qacmygkcsgcsysmm.xyz

Attributes
  • dga_seed

    8584

  • domain_length

    16

  • num_dga_domains

    10000

  • port

    443

Targets

    • Target
      out.exe
    • Size 4.2MB
    • SHA256 bdfbde6a7c86951c60c4910e681e870bcc17554b6260ed6fd22c8930996c7907
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    metastealerdiscoveryexecutionspywarestealer

    • Meta Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

      stealermetastealer

    • MetaStealer payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks