General

  • Target

    ec6437032b5232b2b70a132e094626fe26a93abc934a3f5ef0bbcc677e97adac

  • Size

    344KB

  • Sample

    241101-r3fq7s1grc

  • MD5

    78f1df27a812a4b41a2b2d421894dea7

  • SHA1

    7664095e2eba71f7600bd428dd853f8d65a5b9b1

  • SHA256

    ec6437032b5232b2b70a132e094626fe26a93abc934a3f5ef0bbcc677e97adac

  • SHA512

    49cb09597719efd935ec0192ebe62af87469300e387692d11f6a51363ff0a24c12038aead92024905ac42a3a68e55cf39f419e9e624fc43fc48b139262ea71a7

  • SSDEEP

    6144:4LWlZ5NqhWyIp+btX3AmiKrLnmxLqqlT:4uZ5OIwbBwmkxLq+

Malware Config

Extracted

Family

stealc

Botnet

default9_cap

C2

http://62.204.41.177

Attributes
  • url_path

    /edd20096ecef326d.php

Targets

    • Target

      ec6437032b5232b2b70a132e094626fe26a93abc934a3f5ef0bbcc677e97adac

    • Size

      344KB

    • MD5

      78f1df27a812a4b41a2b2d421894dea7

    • SHA1

      7664095e2eba71f7600bd428dd853f8d65a5b9b1

    • SHA256

      ec6437032b5232b2b70a132e094626fe26a93abc934a3f5ef0bbcc677e97adac

    • SHA512

      49cb09597719efd935ec0192ebe62af87469300e387692d11f6a51363ff0a24c12038aead92024905ac42a3a68e55cf39f419e9e624fc43fc48b139262ea71a7

    • SSDEEP

      6144:4LWlZ5NqhWyIp+btX3AmiKrLnmxLqqlT:4uZ5OIwbBwmkxLq+

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks