metastealer | aa283d1f02c6d3c83dcc1665e9944ed54705e6c46132276c3db208d043e6ca34 | Triage

Sharing

General

Target

setup (2).msi
Size

1.9MB
Sample

241212-nlmawasmfs
MD5

8b77331198791037f336022ef7e269d2
SHA1

c48ddd7547eec8417b295bcd00cbac3c34bd175b
SHA256

aa283d1f02c6d3c83dcc1665e9944ed54705e6c46132276c3db208d043e6ca34
SHA512

d841c91694094cbb1ea9b6f282748ec994c6bd0af3d037831481b9713c28dd8ae79149b93b7a30d2bcdde7875b42ad102ea81de6f99e6c4dd5f25ae7b5d947e5
SSDEEP

24576:ht9cpVDhXukQS9k2+y4csX3+4OkoorlvRaLicTOUKX:WpRhX5VxP4XO4OKrPaLNazX

Score

10^/10

metastealer discovery execution spyware stealer

Malware Config

Extracted

Family

metastealer

C2

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes

dga_seed
21845
domain_length
16
num_dga_domains
10000
port
443

Targets

- Target
  
  setup (2).msi
- Size
  
  1.9MB
- MD5
  
  8b77331198791037f336022ef7e269d2
- SHA1
  
  c48ddd7547eec8417b295bcd00cbac3c34bd175b
- SHA256
  
  aa283d1f02c6d3c83dcc1665e9944ed54705e6c46132276c3db208d043e6ca34
- SHA512
  
  d841c91694094cbb1ea9b6f282748ec994c6bd0af3d037831481b9713c28dd8ae79149b93b7a30d2bcdde7875b42ad102ea81de6f99e6c4dd5f25ae7b5d947e5
- SSDEEP
  
  24576:ht9cpVDhXukQS9k2+y4csX3+4OkoorlvRaLicTOUKX:WpRhX5VxP4XO4OKrPaLNazX
Score

10^/10

discovery metastealer execution spyware stealer
- Meta Stealer
  Meta Stealer steals passwords stored in browsers, written in C++.
  stealer metastealer
- MetaStealer payload
- Metastealer family
  metastealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies file permissions
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

metastealerdiscoveryexecutionspywarestealer