chicken_stealer | aff406fe214a04e22a486323704ef7c623e6af3e933aff0e25195403affe03ff

General

Target
859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294.zip
Size 287KB
Sample261110-p25b3afe52
SHA256 aff406fe214a04e22a486323704ef7c623e6af3e933aff0e25195403affe03ff
MD5 fb8dad7356daadcd8722428731a5a41e
SHA1 3f1d391c333f4588f375f390eac77813cc80f2dd
SHA512 c57964f06c1cae4fc4436740aaf76d730f6c42f7e8f54821e3c227dd03e42bc4d0c3c95942ff79385d5d95d682fd69428d65f1827d84882c8f5bf5ae6f9d0809
SSDEEP 6144:5fKQaGz+9xbfyiDQI1tWzgh0ebqzZ9iwxFp6P8yFbFPi:xKLGzyl62dqu0lzZHxF83FbFPi
TLSH
T14C542364AB4A4FE7740C8BF6A046D0C71103E5FC709BD5ADD05770331ECDA66A0DAA8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

chicken_stealer

C2

https://api.telegram.org/bot8919186852:AAEjTtp7vwrqRVtKiiHSVe2vCXiqQJX8sDc/sendMessage?chat_id=8980143221

Attributes

localhost
127.0.0.1
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Targets

- Target
  859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294
- Size 679KB
- SHA256 859af3d02dbe7bc7ce1fba0396539b1fd37149615293c92e18def55e566b3294
- MD5 3ffe9b94fdd07511c2c8a92d0bf2e8cf
- SHA1 baf3f0291da842279570946f8850ca538cfbf52d
- SHA512 205c53a2b93597426607008038afd3dc6b1d2a9f477673f5330cd8bdb4a5ffb4c5cd55e9c27d25cd6a49bf2fd12ce763a58f58ea53b62b1e81c23775bbf36b34
- SSDEEP 12288:O+tw67SW+Z1acIVFUvW6T/pVfwfzBchoD+r1676Y1GkB2vSVQTkU8rF6H8KXDyP3:F7STZ1aLVK1/pVfw7Bcnr19Y1wTJHnD6
- TLSH
  T1D2E43B36DB5C017DD1B6C1BA8E0B5813E6B238491331BAEB57C11E631E1F6A4A77AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2