General

  • Target

    40122c3fc307277bbcb516dce390f74f27e2f798cb351.exe

  • Size

    5.6MB

  • Sample

    241003-tdcpcstdkp

  • MD5

    07dd73909e1a74b92498058afc918ede

  • SHA1

    2f3f9ab4f17ccd2dfe0c4aada522b00c580c454d

  • SHA256

    40122c3fc307277bbcb516dce390f74f27e2f798cb351a692f820ba7d3ffd735

  • SHA512

    97f66cd575203cfbd0d584475c6696b160071e95466e5dde8b71d66138108f0b4d544af24706720960509fd7fd21bef07e443995457de3805168672844901853

  • SSDEEP

    98304:XUd9wETbKHs4+b4EmeICxgHxC6qz1loJoYFqQ5dn6uqhAoCVtxnz+oEIWoJd:MwgbKM44YCxwxmzLOFfdrq+P/xnCoEIh

Malware Config

Extracted

Family

stealc

Botnet

meowsterioland29

C2

http://5.188.87.43

Attributes
  • url_path

    /29087f1d398f0eec.php

Targets

    • Target

      40122c3fc307277bbcb516dce390f74f27e2f798cb351.exe

    • Size

      5.6MB

    • MD5

      07dd73909e1a74b92498058afc918ede

    • SHA1

      2f3f9ab4f17ccd2dfe0c4aada522b00c580c454d

    • SHA256

      40122c3fc307277bbcb516dce390f74f27e2f798cb351a692f820ba7d3ffd735

    • SHA512

      97f66cd575203cfbd0d584475c6696b160071e95466e5dde8b71d66138108f0b4d544af24706720960509fd7fd21bef07e443995457de3805168672844901853

    • SSDEEP

      98304:XUd9wETbKHs4+b4EmeICxgHxC6qz1loJoYFqQ5dn6uqhAoCVtxnz+oEIWoJd:MwgbKM44YCxwxmzLOFfdrq+P/xnCoEIh

    • Detects HijackLoader (aka IDAT Loader)

    • HijackLoader

      HijackLoader is a multistage loader first seen in 2023.

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Deletes itself

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks