stealc

General

Target
2b091c0eab9477231eb8a65bf5094050829961f5e31580c466e3d228692ce715
Size 3.3MB
Sample260305-da9a6abt5y
SHA256 2b091c0eab9477231eb8a65bf5094050829961f5e31580c466e3d228692ce715
MD5 8121881ff575d692f1f06205b743fe5a
SHA1 df0584a5314651581f9d9d78e79fc2f07f49f598
SHA512 917b9eb2b8a218300c40b1681c5a8226f2dfd8582ac85086a2b4f814cfae60ba78d86fd03ed2ec2df5a93099eed0a2f8666e4c3f9a34e6ebcf0bed4103d59338
SSDEEP 98304:kpmXKq6hbO8rx0ydQ4nutWmL2vJS214Zd3:kpmXKq6M8t0ydLnuImLqg2OP3
TLSH
T12AF5111D22D49559FD1EDA32359B8220D85F6EDE285C93BF6368BB7EB73118DC022318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

stealc

Botnet

tr1pernn

C2

http://178.16.54.175

Attributes

url_path
/fc98bed393364b52.php

rc4.plain

Targets

- Target
  2b091c0eab9477231eb8a65bf5094050829961f5e31580c466e3d228692ce715
- Size 3.3MB
- SHA256 2b091c0eab9477231eb8a65bf5094050829961f5e31580c466e3d228692ce715
- MD5 8121881ff575d692f1f06205b743fe5a
- SHA1 df0584a5314651581f9d9d78e79fc2f07f49f598
- SHA512 917b9eb2b8a218300c40b1681c5a8226f2dfd8582ac85086a2b4f814cfae60ba78d86fd03ed2ec2df5a93099eed0a2f8666e4c3f9a34e6ebcf0bed4103d59338
- SSDEEP 98304:kpmXKq6hbO8rx0ydQ4nutWmL2vJS214Zd3:kpmXKq6M8t0ydLnuImLqg2OP3
- TLSH
  T12AF5111D22D49559FD1EDA32359B8220D85F6EDE285C93BF6368BB7EB73118DC022318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

tr1pernn defense_evasion stealc stealer themida trojan
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Stealc family
  stealc
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Stealc family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2