stealc | 094c4eb7f5480fb893aa6bb24d40b1b36534c0c85ea5e3f8c485146c45328ad6

General

Target
bot_x64.exe
Size 46KB
Sample260724-pfwg2ayvcs
SHA256 094c4eb7f5480fb893aa6bb24d40b1b36534c0c85ea5e3f8c485146c45328ad6
MD5 125eacdebdfc926549fb90c2a655cafc
SHA1 1b38f737003d988290cff328e42fded7249ed6bc
SHA512 8b6ddd5dc786a5c7093c08e0bb7931b2ea67bce749e8a0a96b7af00b9ec7e33535ef9d7fd7c47f303caf849452dece275a211fa6f3d3971501d1737c4cdd35f6
SSDEEP 768:+OZC/PlRFd1usW38oefcLRpOz0xiQzm4iSJCAcHe72J6YDFNxY7x9yqlEznC9:HIlHd1ZWXeELRtxdmhSI5+M17xMx9yq3
TLSH
T134235B9AB7DE0267EC739A38F6651B37EA72B041BE24690F5370C80D2F3653651A4F11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

stealc

Botnet

RUN

C2

http://196.251.107.163

rc4.plain

Targets

- Target
  bot_x64.exe
- Size 46KB
- SHA256 094c4eb7f5480fb893aa6bb24d40b1b36534c0c85ea5e3f8c485146c45328ad6
- MD5 125eacdebdfc926549fb90c2a655cafc
- SHA1 1b38f737003d988290cff328e42fded7249ed6bc
- SHA512 8b6ddd5dc786a5c7093c08e0bb7931b2ea67bce749e8a0a96b7af00b9ec7e33535ef9d7fd7c47f303caf849452dece275a211fa6f3d3971501d1737c4cdd35f6
- SSDEEP 768:+OZC/PlRFd1usW38oefcLRpOz0xiQzm4iSJCAcHe72J6YDFNxY7x9yqlEznC9:HIlHd1ZWXeELRtxdmhSI5+M17xMx9yq3
- TLSH
  T134235B9AB7DE0267EC739A38F6651B37EA72B041BE24690F5370C80D2F3653651A4F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

run discovery stealc persistence stealer
- Detects Stealc stealer Version 2
- Family: Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Stealc stealer Version 2

Family: Stealc

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2