General
-
Target
dbb939fb8b11e194fc8b03ca72644397e99ed91ecf03995eb7b9e0d6ac3c907d
-
Size
493KB
-
Sample
241010-cemsaazekr
-
MD5
97bd4bc22561d694e20a92a863b98b9f
-
SHA1
d75afdb66229cc85a8482777cefd4a9e62154be5
-
SHA256
dbb939fb8b11e194fc8b03ca72644397e99ed91ecf03995eb7b9e0d6ac3c907d
-
SHA512
3a4b96bb61f68a1481c59a831e76703297d9e461f9fcc8ebf0b0d341fc37b6e575ec38b7fdf23030bbcb469f5f55380aa688a1725a40f2315ca4d533e321571f
-
SSDEEP
12288:z6l9sitPVqi7WPc/2HGMOj2K/byYGNihKmwgfUyzM4S:zlitrZRiK/baNiompfjF
Static task
static1
Behavioral task
behavioral1
Sample
dbb939fb8b11e194fc8b03ca72644397e99ed91ecf03995eb7b9e0d6ac3c907d.exe
Resource
win7-20240704-en
Malware Config
Extracted
stealc
default
http://46.8.231.109
-
url_path
/c4754d4f680ead72.php
Targets
-
-
Target
dbb939fb8b11e194fc8b03ca72644397e99ed91ecf03995eb7b9e0d6ac3c907d
-
Size
493KB
-
MD5
97bd4bc22561d694e20a92a863b98b9f
-
SHA1
d75afdb66229cc85a8482777cefd4a9e62154be5
-
SHA256
dbb939fb8b11e194fc8b03ca72644397e99ed91ecf03995eb7b9e0d6ac3c907d
-
SHA512
3a4b96bb61f68a1481c59a831e76703297d9e461f9fcc8ebf0b0d341fc37b6e575ec38b7fdf23030bbcb469f5f55380aa688a1725a40f2315ca4d533e321571f
-
SSDEEP
12288:z6l9sitPVqi7WPc/2HGMOj2K/byYGNihKmwgfUyzM4S:zlitrZRiK/baNiompfjF
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-