Overview

overview

10

Static

static

3

xbad80b145...d7.exe

windows10-2004-x64

10

xbad80b145...d7.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    xbad80b145550725bee88caa50d095c8fd8cf50ecc8d7.exe
  • Size 6.0MB
  • Sample260205-bmfs9scz8d
  • SHA256 bad80b145550725bee88caa50d095c8fd8cf50ecc8d7d2bf532ac862a5d1d402
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
stealcf111stealer

Malware Config

Extracted

Family

  • stealc

Botnet

  • F111

C2

  • http://198.251.89.171

Attributes
  • url_path

    /e86b90f3097e4b27.php

rc4.plain
rc4.plain

Targets

    • Target
      xbad80b145550725bee88caa50d095c8fd8cf50ecc8d7.exe
    • Size 6.0MB
    • SHA256 bad80b145550725bee88caa50d095c8fd8cf50ecc8d7d2bf532ac862a5d1d402
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    f111stealcstealer

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Stealc family

      stealc

    • Executes dropped EXE

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks