General

  • Target

    85735229bd3b6ae1d0c60d43f3e24a2be5f0d21d87b7f2c01f13373c051c82a5

  • Size

    4.6MB

  • Sample

    241104-pysh4ayqdz

  • MD5

    a7e899088ee574a2e977080acb00c849

  • SHA1

    f3e260e8699102d2ee43e1c5a99231005438bb69

  • SHA256

    85735229bd3b6ae1d0c60d43f3e24a2be5f0d21d87b7f2c01f13373c051c82a5

  • SHA512

    00967fe7fd6e9c208df09e96187d4ae39e5c733c75d26079e9a32c66cae6deb66ad2053d4a6ae7df22ce7178605a77f29e64a8a01fd8d1a3f5fef21136918bc7

  • SSDEEP

    49152:G6+uF3aQ8oal2XJfYGClcSHIib2DszK7GSB2kTRBsx5QgAgZrFTZ:G0dalotJBAcl9TaSBvEx5pTZ

Malware Config

Extracted

Family

stealc

Botnet

default

C2

http://194.120.116.120

Attributes
  • url_path

    /7a957ef6cc168ff6.php

rc4.plain

Targets

    • Target

      85735229bd3b6ae1d0c60d43f3e24a2be5f0d21d87b7f2c01f13373c051c82a5

    • Size

      4.6MB

    • MD5

      a7e899088ee574a2e977080acb00c849

    • SHA1

      f3e260e8699102d2ee43e1c5a99231005438bb69

    • SHA256

      85735229bd3b6ae1d0c60d43f3e24a2be5f0d21d87b7f2c01f13373c051c82a5

    • SHA512

      00967fe7fd6e9c208df09e96187d4ae39e5c733c75d26079e9a32c66cae6deb66ad2053d4a6ae7df22ce7178605a77f29e64a8a01fd8d1a3f5fef21136918bc7

    • SSDEEP

      49152:G6+uF3aQ8oal2XJfYGClcSHIib2DszK7GSB2kTRBsx5QgAgZrFTZ:G0dalotJBAcl9TaSBvEx5pTZ

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks