General
- Target http://dawnloadonline.com/devastated/intemperate.ZG93bmxvYWR8M0dvTVRObE5ueDhNVFkzTVRJeE9UQTVOM3g4TWpVNE9YeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeVhR/isla/QXV0b0NBRAQXV.receivables?grownup
- Sample260216-s5cm1ab13f
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://dawnloadonline.com/devastated/intemperate.ZG93bmxvYWR8M0dvTVRObE5ueDhNVFkzTVRJeE9UQTVOM3g4TWpVNE9YeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeVhR/isla/QXV0b0NBRAQXV.receivables?grownup
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
http://dawnloadonline.com/devastated/intemperate.ZG93bmxvYWR8M0dvTVRObE5ueDhNVFkzTVRJeE9UQTVOM3g4TWpVNE9YeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeVhR/isla/QXV0b0NBRAQXV.receivables?grownup
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral3
Sample
http://dawnloadonline.com/devastated/intemperate.ZG93bmxvYWR8M0dvTVRObE5ueDhNVFkzTVRJeE9UQTVOM3g4TWpVNE9YeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeVhR/isla/QXV0b0NBRAQXV.receivables?grownup
Resource
win11-20260130-en
Behavioral task
behavioral4
Sample
http://dawnloadonline.com/devastated/intemperate.ZG93bmxvYWR8M0dvTVRObE5ueDhNVFkzTVRJeE9UQTVOM3g4TWpVNE9YeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeVhR/isla/QXV0b0NBRAQXV.receivables?grownup
Resource
macos-20241101-en
Malware Config
Extracted
-
stealc
-
11111
-
http://217.156.66.135
-
url_path
/4a815a53876a4172.php
Targets
-
- Target http://dawnloadonline.com/devastated/intemperate.ZG93bmxvYWR8M0dvTVRObE5ueDhNVFkzTVRJeE9UQTVOM3g4TWpVNE9YeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeVhR/isla/QXV0b0NBRAQXV.receivables?grownup
Stealc family
Executes dropped EXE
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.