General

  • Target

    dbb939fb8b11e194fc8b03ca72644397e99ed91ecf03995eb7b9e0d6ac3c907d

  • Size

    493KB

  • Sample

    241010-cemsaazekr

  • MD5

    97bd4bc22561d694e20a92a863b98b9f

  • SHA1

    d75afdb66229cc85a8482777cefd4a9e62154be5

  • SHA256

    dbb939fb8b11e194fc8b03ca72644397e99ed91ecf03995eb7b9e0d6ac3c907d

  • SHA512

    3a4b96bb61f68a1481c59a831e76703297d9e461f9fcc8ebf0b0d341fc37b6e575ec38b7fdf23030bbcb469f5f55380aa688a1725a40f2315ca4d533e321571f

  • SSDEEP

    12288:z6l9sitPVqi7WPc/2HGMOj2K/byYGNihKmwgfUyzM4S:zlitrZRiK/baNiompfjF

Malware Config

Extracted

Family

stealc

Botnet

default

C2

http://46.8.231.109

Attributes
  • url_path

    /c4754d4f680ead72.php

Targets

    • Target

      dbb939fb8b11e194fc8b03ca72644397e99ed91ecf03995eb7b9e0d6ac3c907d

    • Size

      493KB

    • MD5

      97bd4bc22561d694e20a92a863b98b9f

    • SHA1

      d75afdb66229cc85a8482777cefd4a9e62154be5

    • SHA256

      dbb939fb8b11e194fc8b03ca72644397e99ed91ecf03995eb7b9e0d6ac3c907d

    • SHA512

      3a4b96bb61f68a1481c59a831e76703297d9e461f9fcc8ebf0b0d341fc37b6e575ec38b7fdf23030bbcb469f5f55380aa688a1725a40f2315ca4d533e321571f

    • SSDEEP

      12288:z6l9sitPVqi7WPc/2HGMOj2K/byYGNihKmwgfUyzM4S:zlitrZRiK/baNiompfjF

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks