General

  • Target

    7ee8a586b2c7b7772a44aed28b4cb7934f13f0939e2573c8adf22cda922790ce

  • Size

    307KB

  • Sample

    241010-b868cazclr

  • MD5

    6ead977356a0302d5712c5c72bf82b65

  • SHA1

    efc7e990984a170dd352e8290fedd1d4d748851c

  • SHA256

    7ee8a586b2c7b7772a44aed28b4cb7934f13f0939e2573c8adf22cda922790ce

  • SHA512

    7f0b88c74179866956e2358e21e4700ed9baf1c28712ee78aea689a8027c62aa05c781984c0e3bdca83657b7d34570d5f1e670ef95c91f46f48680c07e53325a

  • SSDEEP

    6144:aAichYtUokCulxMfpbC2e+PuGEFNnE7w+Uw3NKR9hU/W9:StUoH342pSF94wx8KRF9

Malware Config

Extracted

Family

stealc

Botnet

zalupa

C2

http://95.217.92.42:22

Attributes
  • url_path

    /7db38bfff9324bbe.php

Targets

    • Target

      7ee8a586b2c7b7772a44aed28b4cb7934f13f0939e2573c8adf22cda922790ce

    • Size

      307KB

    • MD5

      6ead977356a0302d5712c5c72bf82b65

    • SHA1

      efc7e990984a170dd352e8290fedd1d4d748851c

    • SHA256

      7ee8a586b2c7b7772a44aed28b4cb7934f13f0939e2573c8adf22cda922790ce

    • SHA512

      7f0b88c74179866956e2358e21e4700ed9baf1c28712ee78aea689a8027c62aa05c781984c0e3bdca83657b7d34570d5f1e670ef95c91f46f48680c07e53325a

    • SSDEEP

      6144:aAichYtUokCulxMfpbC2e+PuGEFNnE7w+Uw3NKR9hU/W9:StUoH342pSF94wx8KRF9

    • Stealc

      Stealc is an infostealer written in C++.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks