stealc | c2ef45750d754850b8f6d448899409379489c5c4380bcf83c4ab6f61c9e01215

General

Target
c2ef45750d754850b8f6d448899409379489c5c4380bcf83c4ab6f61c9e01215
Size 40KB
Sample260601-gqc5faft3m
SHA256 c2ef45750d754850b8f6d448899409379489c5c4380bcf83c4ab6f61c9e01215
MD5 fbfdd9cd005ebd2b4033086ad693cdd8
SHA1 780e14dc895da785e14c37589d7f3ba81c11c9cd
SHA512 502bd2b45e8c02172b7b0b7b4e5aebbfbbca649dfbb1c80c304bd9bbcbee707ee2552b56faf4e20404ce5d949e25479b6e7e59e654d9ae43998d6f7fbeba5b7c
SSDEEP 768:QCBpYx44vJVqtuj5QmsPJ/af9TBSUp/SV9zKXjpjbCl/3Neu79ZaBu:hom4vnqtJPJSj9yEjpClFeuxiu
TLSH
T11B033A3DA29F1186DDE28978E1E622F7E670F6877D14560F8720C41D2F62903B0DCE26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  c2ef45750d754850b8f6d448899409379489c5c4380bcf83c4ab6f61c9e01215
- Size 40KB
- SHA256 c2ef45750d754850b8f6d448899409379489c5c4380bcf83c4ab6f61c9e01215
- MD5 fbfdd9cd005ebd2b4033086ad693cdd8
- SHA1 780e14dc895da785e14c37589d7f3ba81c11c9cd
- SHA512 502bd2b45e8c02172b7b0b7b4e5aebbfbbca649dfbb1c80c304bd9bbcbee707ee2552b56faf4e20404ce5d949e25479b6e7e59e654d9ae43998d6f7fbeba5b7c
- SSDEEP 768:QCBpYx44vJVqtuj5QmsPJ/af9TBSUp/SV9zKXjpjbCl/3Neu79ZaBu:hom4vnqtJPJSj9yEjpClFeuxiu
- TLSH
  T11B033A3DA29F1186DDE28978E1E622F7E670F6877D14560F8720C41D2F62903B0DCE26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader execution stealc svcstealer installer persistence spyware stealer
- Detects Stealc stealer Version 2
- Detects SvcStealer Payload
  SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Family: Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Family: SvcStealer, Diamotrix
  SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
  stealer downloader svcstealer
- Downloads MZ/PE file
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2