stealc_stealer | a755372f32a2b02c856ae22d4c1c766d538ff633e518b98514c7514d565cc700

General

Target
EighteyesLauncher.7z
Size 90.2MB
Sample260624-wlcensd18t
SHA256 a755372f32a2b02c856ae22d4c1c766d538ff633e518b98514c7514d565cc700
MD5 ee2e2916101284aad5f479d081e0c1cd
SHA1 8749a6e2467343506f7e54cbea9b03bf060bb578
SHA512 5c73a4bc5fa80b77781eeaf10c023341114db3cf1c2a996dcbcdb43220b1890c5b64f43230b38a976602b3083533002a708548351bfe993803d1b09258a8fc42
SSDEEP 1572864:/UTqeSmSdphApQEQRmvSU2xMDKzltSaJVxeChPg4f9HUFu75VfvD:1mSdphPNNaDKhY03eCL1HY2DnD
TLSH
T1F328335817C8CE1A91C3983B39FF61B065B40A2BD240B99B5BBADF5783594FE143C4A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Setup.exe
- Size 4.2MB
- SHA256 6fe89486747459936dfb3b53c9dddc6c5c1460f2751dbfbcb19d342bff2ef6fa
- MD5 380d9110382ae4a9ef05cd7d09521705
- SHA1 ca2722a030ce071804da9da9176aa0491f13305a
- SHA512 ff38dea60c01b42532f9d0b3f7aac99cf731fc0a80653a9781e9a7659b8753312e663714c80beaf3ede4a59b53e8b218ef9a7dacb6f78ffe59ab2c4e5cb6b5b7
- SSDEEP 49152:zVg9VRUenmeaVLn56vtoG1kKVCmpHTL4GmuGcGDerOXaT2bge:e7rHPmu8jFbge
- TLSH
  T151264A07A7F901F4D0BBD1798A679657FAB27819873197DF0251465A0F23BE0AE3E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery execution stealc_stealer persistence privilege_escalation spyware stealer trojan
- Family: stealc_stealer
  stealc_stealer
- Detects StealC in memory using payload markers, WinINet APIs and protocol strings
  StealC Stealer.
  stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1