stealc

General

Target
xace74d679d5e8f744b81b05ebbde27c236f778134340536efb1fd4f832073cd5.exe
Size 281KB
Sample260318-e92k2ag12j
SHA256 ace74d679d5e8f744b81b05ebbde27c236f778134340536efb1fd4f832073cd5
MD5 279afdc1181673b42456b0cf6d0c364b
SHA1 c6609c21078dada362c6e11658cd99b33067c85b
SHA512 98c67cfb53070e39c6b6cfa8825a83674ec30283177fb6c86edfbbf306dbdb5a560d67f3ea80bb7bef13984a5e0729b82d7b556daa6948766b18798a91ac9469
SSDEEP 6144:oL0/8IAiofFh13oMnIWB28mnEBlUq3nuAjv6krCYvi9B8ld:owYFh13oMnIWBNLBlUqdjvPrCYn
TLSH
T132546B1A73A40CF8E9B7923DC9564942E772BC160760EBDF03A086572F276D19E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealc 3 stealer

Malware Config

Extracted

Family

stealc

Botnet

3

C2

http://45.131.214.233

Attributes

url_path
/c14fbedecd404e0eba6c.php

rc4.traffic_key

rc4.C2

Targets

- Target
  xace74d679d5e8f744b81b05ebbde27c236f778134340536efb1fd4f832073cd5.exe
- Size 281KB
- SHA256 ace74d679d5e8f744b81b05ebbde27c236f778134340536efb1fd4f832073cd5
- MD5 279afdc1181673b42456b0cf6d0c364b
- SHA1 c6609c21078dada362c6e11658cd99b33067c85b
- SHA512 98c67cfb53070e39c6b6cfa8825a83674ec30283177fb6c86edfbbf306dbdb5a560d67f3ea80bb7bef13984a5e0729b82d7b556daa6948766b18798a91ac9469
- SSDEEP 6144:oL0/8IAiofFh13oMnIWB28mnEBlUq3nuAjv6krCYvi9B8ld:owYFh13oMnIWBNLBlUqdjvPrCYn
- TLSH
  T132546B1A73A40CF8E9B7923DC9564942E772BC160760EBDF03A086572F276D19E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

3 stealc stealer
- Detects Stealc stealer Version 2
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Stealc family
  stealc
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Stealc stealer Version 2

Stealc family

Checks computer location settings

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2