stealc

General

Target
000c2f7718a23707cef9d7a0bea1587cfebbf5f7c866a2c4cd1c800df376f7bc
Size 3.3MB
Sample260305-c1j9aahv2j
SHA256 000c2f7718a23707cef9d7a0bea1587cfebbf5f7c866a2c4cd1c800df376f7bc
MD5 8cf103c306718acf96a1e66d2e788ddf
SHA1 c301df1f90ce11924520a5a757021fc9bcf434be
SHA512 d07474c3dedf9eee84fdb05ff915dc5e5db1b3fff77690762865c038bbddcbd591483549acc027b66f7f1ff12e11e045d95d0f72144eb7ec4bc600a67be65e71
SSDEEP 98304:xziwSmNK5MxhA67sTnkzruQN/vZGVQVYszd:tiwHNDxm67sTnQXZxOY
TLSH
T1AAF53313165D30B9C0BA8E78E52E29630B312FD1A9BA114D2C43F94B433B53E99FA57D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

stealc

Botnet

tr1pernn

C2

http://178.16.54.175

Attributes

url_path
/fc98bed393364b52.php

rc4.plain

Targets

- Target
  000c2f7718a23707cef9d7a0bea1587cfebbf5f7c866a2c4cd1c800df376f7bc
- Size 3.3MB
- SHA256 000c2f7718a23707cef9d7a0bea1587cfebbf5f7c866a2c4cd1c800df376f7bc
- MD5 8cf103c306718acf96a1e66d2e788ddf
- SHA1 c301df1f90ce11924520a5a757021fc9bcf434be
- SHA512 d07474c3dedf9eee84fdb05ff915dc5e5db1b3fff77690762865c038bbddcbd591483549acc027b66f7f1ff12e11e045d95d0f72144eb7ec4bc600a67be65e71
- SSDEEP 98304:xziwSmNK5MxhA67sTnkzruQN/vZGVQVYszd:tiwHNDxm67sTnQXZxOY
- TLSH
  T1AAF53313165D30B9C0BA8E78E52E29630B312FD1A9BA114D2C43F94B433B53E99FA57D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

tr1pernn defense_evasion stealc stealer themida trojan
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Stealc family
  stealc
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Stealc family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2