stealc

General

Target
5c7dbade0d251f8944494bc3b7f5ac443e127f640a8be86a63d6a8e7c9a56d42
Size 3.5MB
Sample260305-dj4r2abz2t
SHA256 5c7dbade0d251f8944494bc3b7f5ac443e127f640a8be86a63d6a8e7c9a56d42
MD5 4555fd6d06e3969a3885f736992f3251
SHA1 9c061dd13a4733a178edfc92481e67b91a0c6558
SHA512 00757494c6d99ddc21d1aba2a48a4bac4c37cb7de2daf128b13a004fb225cd9a9a9a9f1136d3d2c036a240a3e0d62ad04038fb3d09d9fe3f6915886a4b0348f0
SSDEEP 98304:lLX4WdpiECbsl1JPmIXD6R0bTDZniild/Z:F9JPhm4iild/Z
TLSH
T1D8F52254394384B2E82CCF7F61130CDAD3521D187B2986BC2D99FEB38376DB94A5929C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

stealc

Botnet

tr1pernn

C2

http://178.16.54.175

Attributes

url_path
/fc98bed393364b52.php

rc4.plain

Targets

- Target
  5c7dbade0d251f8944494bc3b7f5ac443e127f640a8be86a63d6a8e7c9a56d42
- Size 3.5MB
- SHA256 5c7dbade0d251f8944494bc3b7f5ac443e127f640a8be86a63d6a8e7c9a56d42
- MD5 4555fd6d06e3969a3885f736992f3251
- SHA1 9c061dd13a4733a178edfc92481e67b91a0c6558
- SHA512 00757494c6d99ddc21d1aba2a48a4bac4c37cb7de2daf128b13a004fb225cd9a9a9a9f1136d3d2c036a240a3e0d62ad04038fb3d09d9fe3f6915886a4b0348f0
- SSDEEP 98304:lLX4WdpiECbsl1JPmIXD6R0bTDZniild/Z:F9JPhm4iild/Z
- TLSH
  T1D8F52254394384B2E82CCF7F61130CDAD3521D187B2986BC2D99FEB38376DB94A5929C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

tr1pernn defense_evasion stealc stealer themida trojan
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Stealc family
  stealc
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Stealc family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2