General
- Target 280d5c69c95d828ff8c0c34099702f169c3d5b11b1b6ca1ba80c8aaf1161249e.bin
- Size 12.2MB
- Sample260731-q3hecsvxcs
- SHA256 280d5c69c95d828ff8c0c34099702f169c3d5b11b1b6ca1ba80c8aaf1161249e
Malware Config
Extracted
-
stealc
-
eu1
-
http://193.148.57.10/88004f4d3e32489389ea.php
-
url_path
/88004f4d3e32489389ea.php
Targets
-
- Target 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf
- Size 141KB
- SHA256 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4
Score6/10-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
-
- Target 04614935b46d278acf30fbd275dfa2b55e19a1a96ece17be852325305469343e.sh
- Size 617B
- SHA256 04614935b46d278acf30fbd275dfa2b55e19a1a96ece17be852325305469343e
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
- Target 1737369bee038e31b39e2cb66b9dd18ecbec92a7be1324adc16060682141f2fd.exe
- Size 1.8MB
- SHA256 1737369bee038e31b39e2cb66b9dd18ecbec92a7be1324adc16060682141f2fd
Score10/10-
Family: Stealc
Stealc is an infostealer written in C++.
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
- Target 1ca3b901935fead67478eae99eaf7061c871fc0fcea3403086a0c5cc154c1f3f.elf
- Size 102KB
- SHA256 1ca3b901935fead67478eae99eaf7061c871fc0fcea3403086a0c5cc154c1f3f
Score1/10 -
- Target 34d2e47fa8f6b64e346623b4ed66898b86d53891900b953e69f02e2b3ffb2cc9.sh
- Size 2KB
- SHA256 34d2e47fa8f6b64e346623b4ed66898b86d53891900b953e69f02e2b3ffb2cc9
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies init.d
Adds/modifies system service, likely for persistence.
-
Modifies rc script
Adding/modifying system rc scripts is a common persistence mechanism.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Write file to user bin folder
-
Writes file to system bin folder
-
Modifies Bash startup script
-
- Target 404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69.elf
- Size 6.8MB
- SHA256 404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69
Score6/10-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
- Target 4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
- Size 4.6MB
- SHA256 4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8
Score7/10-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target 533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582.sh
- Size 44KB
- SHA256 533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582
Score8/10-
Modifies password files for system users/ groups
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Deletes Audit logs
Deletes logs related to the Linux Audit framework.
-
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
-
Adds a user to the system
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Deletes log files
Deletes log files on the system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies rc script
Adding/modifying system rc scripts is a common persistence mechanism.
-
Modifies Bash startup script
-
- Target 68bd19635359188ea8ab42541ba0e573b34a1819fde6115e8dced39c4ebd97b9.elf
- Size 111KB
- SHA256 68bd19635359188ea8ab42541ba0e573b34a1819fde6115e8dced39c4ebd97b9
Score1/10 -
- Target 94fdbdfea6c70f8d83acf32f495584ff7a25c9270bfb36fe045eb43efb7ac04d.elf
- Size 78KB
- SHA256 94fdbdfea6c70f8d83acf32f495584ff7a25c9270bfb36fe045eb43efb7ac04d
Score1/10 -
- Target b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf
- Size 383KB
- SHA256 b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d
Score6/10-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
-
- Target e4697c702263e186097be61c198ffc5a148631b1d3db08f2b515c1b742f8e919.elf
- Size 114KB
- SHA256 e4697c702263e186097be61c198ffc5a148631b1d3db08f2b515c1b742f8e919
Score1/10 -
- Target ef5d4d0fbfd73d3e50607ac5f62287ec6f9045ce6fb5940afeab6bb2601b0cb6.elf
- Size 54KB
- SHA256 ef5d4d0fbfd73d3e50607ac5f62287ec6f9045ce6fb5940afeab6bb2601b0cb6
Score4/10 -
- Target ffb744e91515a6bdb0bf0588065455efd591250c882026b6c16f6afca11ca98f.elf
- Size 72KB
- SHA256 ffb744e91515a6bdb0bf0588065455efd591250c882026b6c16f6afca11ca98f
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
5XDG Autostart Entries
2Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Modify Authentication Process
1Pluggable Authentication Modules
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
5XDG Autostart Entries
2Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Indicator Removal
2Clear Linux or Mac System Logs
2Modify Authentication Process
1Pluggable Authentication Modules
1Modify Registry
1Virtualization/Sandbox Evasion
1System Checks
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Pluggable Authentication Modules
1OS Credential Dumping
2/etc/passwd and /etc/shadow
1Proc Filesystem
1Unsecured Credentials
1Credentials In Files
1Discovery
Query Registry
1System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
3Internet Connection Discovery
2System Network Connections Discovery
1Virtualization/Sandbox Evasion
1System Checks
1