General

  • Target

    cc145c05b9002ce5a149411e889dbe71edba87faac919721e123894419f2cfb3.exe

  • Size

    1.7MB

  • Sample

    241124-c7jw4aznez

  • MD5

    e5d2a005324f86d304edcf35dacacc99

  • SHA1

    3dddc9132b3abe56f4f2606c76349fe7e93107ad

  • SHA256

    cc145c05b9002ce5a149411e889dbe71edba87faac919721e123894419f2cfb3

  • SHA512

    ffb55af173fd4d2d1909f4da673e4b3d4d7f62c7cb312c3f80df0fb643565dfaaedcc1ee320035362e7ac29161cef67adfdcaa2199e74aefff2d650284f6c4e4

  • SSDEEP

    49152:tw20saa8GDgxrrPlNLV8b8VqeZ+gb/tG52T4jhpQIDY7:twBa8rfV3+83yhWeY

Malware Config

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Targets

    • Target

      cc145c05b9002ce5a149411e889dbe71edba87faac919721e123894419f2cfb3.exe

    • Size

      1.7MB

    • MD5

      e5d2a005324f86d304edcf35dacacc99

    • SHA1

      3dddc9132b3abe56f4f2606c76349fe7e93107ad

    • SHA256

      cc145c05b9002ce5a149411e889dbe71edba87faac919721e123894419f2cfb3

    • SHA512

      ffb55af173fd4d2d1909f4da673e4b3d4d7f62c7cb312c3f80df0fb643565dfaaedcc1ee320035362e7ac29161cef67adfdcaa2199e74aefff2d650284f6c4e4

    • SSDEEP

      49152:tw20saa8GDgxrrPlNLV8b8VqeZ+gb/tG52T4jhpQIDY7:twBa8rfV3+83yhWeY

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks