General
- Target MegaBasterd.Setup.Files (infected).7z
- Size 6.0MB
- Sample261111-esfx1atw6k
- SHA256 0ee0c280a28a48bfc4ce09b18b7351d89ed8ef79a16efa311b2be7916a4e1231
Score
10/10
Malware Config
Extracted
Family
-
stealc
Botnet
-
dexa
C2
-
http://151.243.28.4
rc4.traffic_key
rc4.plain
Targets
-
- Target MegaBasterd.Setup.Files/Dropped files/vlc_1.exe
- Size 9.6MB
- SHA256 0f64b4d5288f88f16165eebe27242281ba80095380491cc77406ee647be614d7
Score6/10Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
- Target MegaBasterd.Setup.Files/MegaBasterd.exe
- Size 4.7MB
- SHA256 58d8703d6bdd6370ca2c86e006d344dcb092b452b004d81d0d3977dee9fc1289
Score10/10Detects Stealc stealer Version 3
Family: Stealc
Stealc is an infostealer written in C++.
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
Suspicious use of NtCreateUserProcessOtherParentProcess
XMRig Miner payload
Downloads MZ/PE file
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Accesses cryptocurrency files/wallets, possible credential harvesting
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Process Injection
1Process Hollowing
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Obfuscated Files or Information
1Command Obfuscation
1Process Injection
1Process Hollowing
1