stealc | f895e01a9d2539ecb9e70c3d842e3c70de5db28c3fbee749b2919d2657184697

General

Target
2026-09-29_06b7cba379f78507526267f88a77952e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 4.3MB
Sample260930-gprlfasdpg
SHA256 f895e01a9d2539ecb9e70c3d842e3c70de5db28c3fbee749b2919d2657184697
MD5 06b7cba379f78507526267f88a77952e
SHA1 cad4f9b0132da6da7ee65e6d1cf8f4beab3051c9
SHA512 5f25a250abadcfd8f1e7062012ceee804a28f3a4a0bd30bca4cd5512db3c9446d74d790323098ee91dc2dab1a1c5a95faf0da41d725b1cf750a8fba4489b2f46
SSDEEP 49152:hZFMEmN1jWGG8zqE661OEPzO5FvrfWWQOf38s1+vwYcgRDSRnuat1T0b2cMRL8FX:4fSO4fKwU2MScMRL
TLSH
T156265A4BA7F900F5D0BAE17A8A679517FA727819873197DF0291431A0F23BE09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-29_06b7cba379f78507526267f88a77952e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 4.3MB
- SHA256 f895e01a9d2539ecb9e70c3d842e3c70de5db28c3fbee749b2919d2657184697
- MD5 06b7cba379f78507526267f88a77952e
- SHA1 cad4f9b0132da6da7ee65e6d1cf8f4beab3051c9
- SHA512 5f25a250abadcfd8f1e7062012ceee804a28f3a4a0bd30bca4cd5512db3c9446d74d790323098ee91dc2dab1a1c5a95faf0da41d725b1cf750a8fba4489b2f46
- SSDEEP 49152:hZFMEmN1jWGG8zqE661OEPzO5FvrfWWQOf38s1+vwYcgRDSRnuat1T0b2cMRL8FX:4fSO4fKwU2MScMRL
- TLSH
  T156265A4BA7F900F5D0BAE17A8A679517FA727819873197DF0291431A0F23BE09E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery stealc persistence privilege_escalation spyware stealer
- Detects Stealc stealer Version 3
- Family: Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2