General
- Target atb_certificate.zip
- Size 331KB
- Sample261111-dtmw9sdv8r
- SHA256 6e09e64308d331f3da30c5f652b445cfb5e72c0f48f23049eb1d9ce7ecb0c24f
Score
10/10
Malware Config
Targets
-
- Target atb_certificate.exe
- Size 668KB
- SHA256 0ab1cedab2185efefb9d52dbe1c84737d9bbd8878c003932fe8595bbeb30b688
Score10/10Detects Stealc stealer Version 3
Family: Stealc
Stealc is an infostealer written in C++.
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Executes dropped EXE
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
2Credentials in Registry
1