General

  • Target
    SecuriteInfo.com.Win64.MalwareX-gen.47427539.exe
  • Size 3.0MB
  • Sample251116-rlt79syncq
  • SHA256 238693578a24dab8184c5ee795cd5369ebc7956adb0eaa6e1a1de7f006d5514b
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • stealc

Botnet
  • tr1pernn

C2
  • https://ultra-dynamic-systems-247-compute-portal.com

Attributes
  • url_path

    /fc98bed393364b52.php

rc4.plain

Targets

    • Target
      SecuriteInfo.com.Win64.MalwareX-gen.47427539.exe
    • Size 3.0MB
    • SHA256 238693578a24dab8184c5ee795cd5369ebc7956adb0eaa6e1a1de7f006d5514b
    • MD5 SHA1 SHA512 SSDEEP
    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v16

Tasks