General

  • Target

    fast_copy.exe

  • Size

    5.6MB

  • Sample

    241104-w92z8svhkk

  • MD5

    f659a0d8ebd02ee8ee6eb70cef397cd7

  • SHA1

    78c4038cd147d6e14cb0255e7ff170d477e9eca4

  • SHA256

    307abb12c62dd8421cedfe6a11475e742caaae82faf9cb14d9812772edefe8d7

  • SHA512

    ae5275a56c782960d7d3efdd32d8458300b763114d040723b363f51dbd77ae6e371ef3d4081745feac202890284c77ddf8e796289a473eb43b998172b6eaddb9

  • SSDEEP

    98304:AUd98EKniqMUs8RVe0jHs4+b4EmeICxgHxC6qz1loJoYFqQ5dn6uqhAoCVtxnz+C:F8sn+RVJM44YCxwxmzLOFfdrq+P/xnCC

Malware Config

Extracted

Family

stealc

Botnet

benjiworld29

C2

http://45.159.208.21

Attributes
  • url_path

    /e24f48bbd86dab7e.php

Targets

    • Target

      fast_copy.exe

    • Size

      5.6MB

    • MD5

      f659a0d8ebd02ee8ee6eb70cef397cd7

    • SHA1

      78c4038cd147d6e14cb0255e7ff170d477e9eca4

    • SHA256

      307abb12c62dd8421cedfe6a11475e742caaae82faf9cb14d9812772edefe8d7

    • SHA512

      ae5275a56c782960d7d3efdd32d8458300b763114d040723b363f51dbd77ae6e371ef3d4081745feac202890284c77ddf8e796289a473eb43b998172b6eaddb9

    • SSDEEP

      98304:AUd98EKniqMUs8RVe0jHs4+b4EmeICxgHxC6qz1loJoYFqQ5dn6uqhAoCVtxnz+C:F8sn+RVJM44YCxwxmzLOFfdrq+P/xnCC

    • Detects HijackLoader (aka IDAT Loader)

    • HijackLoader

      HijackLoader is a multistage loader first seen in 2023.

    • Hijackloader family

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks