Overview

overview

10

Static

static

1

18262829011200.js

windows7-x64

10

18262829011200.js

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3189efaf23301_mail77d2817cfb69a8bfa3b846c24ec534aa3e6b66c8a28f3b18d4bXxX6Zip.zip
  • Size 178KB
  • Sample241103-tk2basyakf
  • SHA256 3189efaf2330177d2817cfb69a8bfa3b846c24ec534aa3e6b66c8a28f3b18d4b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
streladefense_evasionexecutionstealer

Malware Config

Extracted

Family

  • strela

C2

  • 193.109.85.231

Attributes
  • url_path

    /server.php

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537

Targets

    • Target
      18262829011200.js
    • Size 345KB
    • SHA256 544887bc3f0dccb610dd7ba35b498a03ea32fca047e133a0639d5bca61cc6f45
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    streladefense_evasionexecutionstealer

    • Detects Strela Stealer payload

    • Strela family

      strela

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

      stealerstrela

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Deobfuscate/Decode Files or Information

      Payload decoded via CertUtil.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks