metastealer | 06fc504715fa08463d9e590a47d4f01224f1e4bf93644ce369af73f15f24d76d | Triage

Sharing

General

Target

setupxe.exe
Size

704.5MB
Sample

250206-12wwga1jhq
MD5

348984ceda7e622fa7e601c035af02f2
SHA1

017eacd999cab363b88e8585726b95ede7a7a639
SHA256

06fc504715fa08463d9e590a47d4f01224f1e4bf93644ce369af73f15f24d76d
SHA512

6091a8cadcfe11d309a4fc4f24d73391908219bf5841ac90ede59a518d1ad60162815a065dc912b0a4d7cb455ba2546faa7c8d248a7fde8ac53f9ed24e53cbc9
SSDEEP

49152:jF6wK3xvyo8le8M+U1djucnoxYcBD5c6qnF+qYBQd:+BUeRdjoacBD5c6qFD

Score

10^/10

metastealer discovery execution spyware stealer

Malware Config

Extracted

Family

metastealer

C2

kagkimuoakomksww.xyz

cwikwiiisuyqymso.xyz

qgimwqowkmuicoos.xyz

kuueskmwqmwoocuq.xyz

eaeueussigokssqg.xyz

eoyqkgcyoesysssk.xyz

ocmmqamiyucswwik.xyz

eimemucysaammomg.xyz

iwomsoekyisuymws.xyz

mqykiccmwokeumes.xyz

iqqcgqqseysecuum.xyz

iqmoyikmqymsmcwm.xyz

aseuqoqgaueaymyo.xyz

wycuamkomemmigmy.xyz

ceiyeqaoscmsamim.xyz

skcqkaykccckqyam.xyz

kaycmqwocuyyuqyg.xyz

mqssyaeoeeucegqy.xyz

ywqamawcqumaqiyq.xyz

skscsegicyqikqww.xyz

Attributes

dga_seed
12914
domain_length
16
num_dga_domains
10000
port
443

Targets

- Target
  
  setupxe.exe
- Size
  
  704.5MB
- MD5
  
  348984ceda7e622fa7e601c035af02f2
- SHA1
  
  017eacd999cab363b88e8585726b95ede7a7a639
- SHA256
  
  06fc504715fa08463d9e590a47d4f01224f1e4bf93644ce369af73f15f24d76d
- SHA512
  
  6091a8cadcfe11d309a4fc4f24d73391908219bf5841ac90ede59a518d1ad60162815a065dc912b0a4d7cb455ba2546faa7c8d248a7fde8ac53f9ed24e53cbc9
- SSDEEP
  
  49152:jF6wK3xvyo8le8M+U1djucnoxYcBD5c6qnF+qYBQd:+BUeRdjoacBD5c6qFD
Score

10^/10

discovery metastealer execution spyware stealer
- Meta Stealer
  Meta Stealer steals passwords stored in browsers, written in C++.
  stealer metastealer
- MetaStealer payload
- Metastealer family
  metastealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

metastealerdiscoveryexecutionspywarestealer