General

  • Target

    JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96

  • Size

    976.8MB

  • Sample

    241229-rkb1astkdq

  • MD5

    9eef61663c37e1dabc5e4de19a3313a3

  • SHA1

    066a28ae74d8da84e143885a90c2e0ab8d0d7f9b

  • SHA256

    3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96

  • SHA512

    c50a09d8d4158b39918ffa73f05c77009ae07fbd05b8523b6be7b02bc2a67ece6880e5c60642a6f1887b43ea8ac5ac790131f845f7ac23666a710339f5b252fc

  • SSDEEP

    6144:2sDnM7qRmzF9PvkeskjFfhmiMMFjCNDP2UhDc66APSIfLf5Pr3f2X:cqgnPRskjHmia2X

Malware Config

Extracted

Family

stealc

Botnet

default

C2

http://176.113.115.26

Attributes
  • url_path

    /e50a8a413d120466.php

rc4.plain

Targets

    • Target

      JaffaCakes118_3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96

    • Size

      976.8MB

    • MD5

      9eef61663c37e1dabc5e4de19a3313a3

    • SHA1

      066a28ae74d8da84e143885a90c2e0ab8d0d7f9b

    • SHA256

      3a2b1123db2f3e070c1b4ba46966b74280aba6104d85c7a05d4719d8641c2d96

    • SHA512

      c50a09d8d4158b39918ffa73f05c77009ae07fbd05b8523b6be7b02bc2a67ece6880e5c60642a6f1887b43ea8ac5ac790131f845f7ac23666a710339f5b252fc

    • SSDEEP

      6144:2sDnM7qRmzF9PvkeskjFfhmiMMFjCNDP2UhDc66APSIfLf5Pr3f2X:cqgnPRskjHmia2X

    • Detects Stealc stealer

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks