General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
stealc
Botnet
default
C2
https://steamcommunity.com/profiles/76561198035868993
Attributes
-
url_path
/43e1e04e93874aba.php
Targets
-
-
Target
https://modesoft.org/license-Key-Activator
-
Stealc family
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4