General

  • Target

    JaffaCakes118_7944f3816d40038d0921de513010f7f1d49b9ba56c18da88ee952c09fc8eab6d

  • Size

    687.5MB

  • Sample

    241222-hxdvzsylgw

  • MD5

    79d52020287e3977104d75fc7471e32a

  • SHA1

    46dd7c10fe7bf8b9148ce75e4043c6f0bd00ba4c

  • SHA256

    7944f3816d40038d0921de513010f7f1d49b9ba56c18da88ee952c09fc8eab6d

  • SHA512

    a4e5a83bb233fab55fac9a717a5f297c0fb032f79fb68cac7acd6127dc41c4c88ad467c11d66a6ae8650c296ad8aae3dcdcfe93bbcc29b6082d2ac4146e83d32

  • SSDEEP

    3072:U4Pz9hyuZrybA33ZHLnULZMBJlJJxbY/13oAbE6S91Kk7sK5ZKwBYxL6dUNX:5LTpz3Z0wxbYr4P91JsK5k3cUNX

Malware Config

Extracted

Family

stealc

Botnet

default

C2

http://185.99.133.229

Attributes
  • url_path

    /4107e896e74f964e.php

rc4.plain

Targets

    • Target

      JaffaCakes118_7944f3816d40038d0921de513010f7f1d49b9ba56c18da88ee952c09fc8eab6d

    • Size

      687.5MB

    • MD5

      79d52020287e3977104d75fc7471e32a

    • SHA1

      46dd7c10fe7bf8b9148ce75e4043c6f0bd00ba4c

    • SHA256

      7944f3816d40038d0921de513010f7f1d49b9ba56c18da88ee952c09fc8eab6d

    • SHA512

      a4e5a83bb233fab55fac9a717a5f297c0fb032f79fb68cac7acd6127dc41c4c88ad467c11d66a6ae8650c296ad8aae3dcdcfe93bbcc29b6082d2ac4146e83d32

    • SSDEEP

      3072:U4Pz9hyuZrybA33ZHLnULZMBJlJJxbY/13oAbE6S91Kk7sK5ZKwBYxL6dUNX:5LTpz3Z0wxbYr4P91JsK5k3cUNX

    • Detects Stealc stealer

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks