Overview

overview

10

Static

static

10

249d84a486...aa.exe

windows10-2004-x64

10

249d84a486...aa.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    249d84a486e2449321bbcf1f7bd8b0f085022b59fdc5bc694d38734b63a90caa.exe
  • Size 5.9MB
  • Sample260325-n526faex4w
  • SHA256 249d84a486e2449321bbcf1f7bd8b0f085022b59fdc5bc694d38734b63a90caa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
c0destealerchromelevatorexecutionhacktoolpersistencespywarestealer

Malware Config

Extracted

Family

  • c0destealer

C2

  • http://113.30.151.250/panel/receiver.php

  • http://113.30.151.250/panel/upload_screenshot.php

  • http://113.30.151.250/panel/command.php

  • http://113.30.151.250/panel/heartbeat.php

  • http://113.30.151.250/panel/craftrise.php

  • http://113.30.151.250/panel/chrome.php

Targets

    • Target
      249d84a486e2449321bbcf1f7bd8b0f085022b59fdc5bc694d38734b63a90caa.exe
    • Size 5.9MB
    • SHA256 249d84a486e2449321bbcf1f7bd8b0f085022b59fdc5bc694d38734b63a90caa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    executionc0destealerchromelevatorhacktoolpersistencespywarestealer

    • C0deStealer

      C0deStealer is a stealer written in C++.

      stealerc0destealer

    • C0destealer family

      c0destealer

    • ChromElevator

      ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.

      hacktoolchromelevator

    • Chromelevator family

      chromelevator

    • Detects C0deStealer payload

    • Detects ChromElevator

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks